4 ms·

The privacy protection is a benefit, but it is balanced against accessibility, which is often more important, such as when trying to access important informatio

The privacy protection is a benefit, but it is balanced against accessibility, which is often more important, such as when trying to access important information on an older device.

josephcsible 3y ago
How old is the last device you know of that supports insecure HTTP but not HTTPS?
- sam_lowry_ 3y ago
  My Mikrotik routers? My Openwrt routers? Lots of networking equipment works over HTTP only, still. I am actually really pissed off that I can not use Chromium password manager to save HTTP credentials for these devices.
  - Railander 3y ago
    > Lots of networking equipment works over HTTP only, still. MikroTik has supported https for a very very long time, though it comes disabled by default and even if it didn't it wouldn't work because it requires the user creating/importing a cert to use with it. At least the cert manager is quite intricate and they have a video (assuming the device has a valid WAN IP) on how to set it up with letsencrypt.
  - josephcsible 3y ago
    Both of those do support HTTPS: https://wiki.mikrotik.com/wiki/Manual:Webfig#Enabling_HTTPS https://wiki.mikrotik.com/wiki/Manual:Webfig#Enabling_HTTPS https://openwrt.org/docs/guide-user/luci/luci.secure https://openwrt.org/docs/guide-user/luci/luci.secure
    - sam_lowry_ 3y ago
      This is not the default, and frankly should not be.
- bscphil 3y ago
  Usually supporting HTTPS is combined with requiring relatively recent versions of TLS and cipher suites, for security reasons. I've been in a position where I needed to use a computer from ~2007 or so briefly and found that I couldn't access a huge fraction of websites, despite the fact that the browser "supported" HTTPS.
  - pixl97 3y ago
    2007 on the modern internet... how fast was it compromised when you clicked the wrong link.
    - forgotmypw17 3y ago
      I regularly use old and older devices in my work, and they work fine as long as I don't go to random shady corners of the Web.
  - josephcsible 3y ago
    Firefox 27 runs on systems as old as Windows XP SP2, and it supports TLS 1.2 and the TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 and TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 cipher suites, which are still considered up-to-date and don't have any known vulnerabilities. If a computer from 2007 couldn't reach modern TLS sites, then it was just behind on updates that were available to it.
    - forgotmypw17 3y ago
      I've commented on this issue before, as I do a lot of testing in the accessibility space, so I'm just going to paste a previous comment: --- Only a few of the barriers presented by HTTPS: Clock sync would be a requirement for access. A recent device would be a requirement for access (not everyone can afford a new one). Site admin keeping up with certificate registration would be a requirement. Approval from the centralized certificate authority would be a requirement. Server's self domain name matching accessed domain name would be a requirement. These are all real scenarios where real people can be denied access to information that is crucial to them, up to the point of survival. Just a few of the reasons why all my websites still allow HTTP. HTTP is also way faster on slow connections. --- https://news.ycombinator.com/item?id=35800566 https://news.ycombinator.com/item?id=35800566
- forgotmypw17 3y ago
  Not that old, if you take into account that older HTTPS versions are often not supported by the server. As little as 5 years, in my experience.
  - josephcsible 3y ago
    What 5-year-old device only supports older than TLS 1.2? (I assume that's what you meant by "older HTTPS versions".)
    - forgotmypw17 3y ago
      I understand your skepticism, but I'm coming from years of actual testing on many real-world devices that people use everyday and have no agency in upgrading for various reasons. As I mentioned in other comments, there are many possible areas where HTTPS can present a barrier to a user's access to your resource. Some of these I listed in another comment, which I copy below: --- Only a few of the barriers presented by HTTPS: Clock sync would be a requirement for access. A recent device would be a requirement for access (not everyone can afford a new one). Site admin keeping up with certificate registration would be a requirement. Approval from the centralized certificate authority would be a requirement. Server's self domain name matching accessed domain name would be a requirement. These are all real scenarios where real people can be denied access to information that is crucial to them, up to the point of survival. Just a few of the reasons why all my websites still allow HTTP. HTTP is also way faster on slow connections. --- https://news.ycombinator.com/item?id=35800566 https://news.ycombinator.com/item?id=35800566
      - josephcsible 3y ago
        That doesn't answer what I asked at all, and I already rebutted those points in the other place you posted that: https://news.ycombinator.com/item?id=36597183 https://news.ycombinator.com/item?id=36597183

The privacy protection is a benefit, but it is balanced against accessibility, which is often more important, such as when trying to access important information on an older device.

josephcsible 3y ago

How old is the last device you know of that supports insecure HTTP but not HTTPS?

sam_lowry_ 3y ago
My Mikrotik routers? My Openwrt routers? Lots of networking equipment works over HTTP only, still. I am actually really pissed off that I can not use Chromium password manager to save HTTP credentials for these devices.
- Railander 3y ago
  > Lots of networking equipment works over HTTP only, still. MikroTik has supported https for a very very long time, though it comes disabled by default and even if it didn't it wouldn't work because it requires the user creating/importing a cert to use with it. At least the cert manager is quite intricate and they have a video (assuming the device has a valid WAN IP) on how to set it up with letsencrypt.
- josephcsible 3y ago
  Both of those do support HTTPS: https://wiki.mikrotik.com/wiki/Manual:Webfig#Enabling_HTTPS https://wiki.mikrotik.com/wiki/Manual:Webfig#Enabling_HTTPS https://openwrt.org/docs/guide-user/luci/luci.secure https://openwrt.org/docs/guide-user/luci/luci.secure
  - sam_lowry_ 3y ago
    This is not the default, and frankly should not be.
bscphil 3y ago
Usually supporting HTTPS is combined with requiring relatively recent versions of TLS and cipher suites, for security reasons. I've been in a position where I needed to use a computer from ~2007 or so briefly and found that I couldn't access a huge fraction of websites, despite the fact that the browser "supported" HTTPS.
- pixl97 3y ago
  2007 on the modern internet... how fast was it compromised when you clicked the wrong link.
  - forgotmypw17 3y ago
    I regularly use old and older devices in my work, and they work fine as long as I don't go to random shady corners of the Web.
- josephcsible 3y ago
  Firefox 27 runs on systems as old as Windows XP SP2, and it supports TLS 1.2 and the TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 and TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 cipher suites, which are still considered up-to-date and don't have any known vulnerabilities. If a computer from 2007 couldn't reach modern TLS sites, then it was just behind on updates that were available to it.
  - forgotmypw17 3y ago
    I've commented on this issue before, as I do a lot of testing in the accessibility space, so I'm just going to paste a previous comment: --- Only a few of the barriers presented by HTTPS: Clock sync would be a requirement for access. A recent device would be a requirement for access (not everyone can afford a new one). Site admin keeping up with certificate registration would be a requirement. Approval from the centralized certificate authority would be a requirement. Server's self domain name matching accessed domain name would be a requirement. These are all real scenarios where real people can be denied access to information that is crucial to them, up to the point of survival. Just a few of the reasons why all my websites still allow HTTP. HTTP is also way faster on slow connections. --- https://news.ycombinator.com/item?id=35800566 https://news.ycombinator.com/item?id=35800566
forgotmypw17 3y ago
Not that old, if you take into account that older HTTPS versions are often not supported by the server. As little as 5 years, in my experience.
- josephcsible 3y ago
  What 5-year-old device only supports older than TLS 1.2? (I assume that's what you meant by "older HTTPS versions".)
  - forgotmypw17 3y ago
    I understand your skepticism, but I'm coming from years of actual testing on many real-world devices that people use everyday and have no agency in upgrading for various reasons. As I mentioned in other comments, there are many possible areas where HTTPS can present a barrier to a user's access to your resource. Some of these I listed in another comment, which I copy below: --- Only a few of the barriers presented by HTTPS: Clock sync would be a requirement for access. A recent device would be a requirement for access (not everyone can afford a new one). Site admin keeping up with certificate registration would be a requirement. Approval from the centralized certificate authority would be a requirement. Server's self domain name matching accessed domain name would be a requirement. These are all real scenarios where real people can be denied access to information that is crucial to them, up to the point of survival. Just a few of the reasons why all my websites still allow HTTP. HTTP is also way faster on slow connections. --- https://news.ycombinator.com/item?id=35800566 https://news.ycombinator.com/item?id=35800566
    - josephcsible 3y ago
      That doesn't answer what I asked at all, and I already rebutted those points in the other place you posted that: https://news.ycombinator.com/item?id=36597183 https://news.ycombinator.com/item?id=36597183