4 ms·

> For this reason, this website does not enforce HTTPS/SSL No SSL on the website means someone could easily MITM the connection and serve something else. That’

> For this reason, this website does not enforce HTTPS/SSL No SSL on the website means someone could easily MITM the connection and serve something else. That’s a very bad decision short of providing a different form of cryptographic authentication. SSL isn’t just for encryption, friends.

Dalewyn 3y ago
I've only ever been inconvenienced by HTTPS/SSL 99% of the time because 99% of my browsing doesn't involve transmitting sensitive information like my credit cards. Passwords? I couldn't care less if someone were to waylay 99% of my passwords. For the remaining 1% HTTPS/SSL definitely serve a legitimate purpose, but as for the other 99% it's a fucking nuisance and I find websites that don't force the issue a breath of fresh air.
- saagarjha 3y ago
  I’d appreciate the password to your account then.
redder23 3y ago
Get ready for getting downvoted, these people want to get hacked! I made a comment about how unsecure it is to run a 20+ year old OS and I got downvoted. These people hate facts, just like on Reddit. They are so delusional they think some "sandbox" in the Browser that some dude ported back is fixing 20+ years of security holes in the OS, this is so funny.
- OsrsNeedsf2P 3y ago
  Depends on your threat model. Back in the real world, more users have been hacked by Windows 10's update system than running XP since 2020.
- dang 3y ago
  Can you please stop posting like this to HN? We have to ban accounts that do it, for reasons which should be clear if you review https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html. I don't want to ban you because you've also posted some good things, but we've already warned you once, and you've unfortunately been continuing to break the rules quite badly—not just in this thread but in others. To mention a couple recent examples: https://news.ycombinator.com/item?id=39467401 https://news.ycombinator.com/item?id=39467401 https://news.ycombinator.com/item?id=39458160 https://news.ycombinator.com/item?id=39458160 If this keeps up, we're going to have to ban you. If you'd please review https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and stick to the rules when posting here, we'd appreciate it.
toast0 3y ago
They do have SSL on the website, but it's optional. But assuming MITM, the only defense against MITM a site owner has is getting preloaded on the HSTS list. Refusing to serve content in HTTP doesn't help, because the MITM can upgrade the request on the backend. Redirecting from HTTP to HTTPS is window dressing. For a site like this, I might version sniff and send modern browsers to a favicon served over HTTPS with HSTS headers; future accesses will get upgraded to HTTPS (unless the MITM drops these requests), and older browsers don't understand HSTS anyway. But I wouldn't put that favicon on generally, because it's not likely possible to get a certificate older browsers will like, and older browsers like to throw popups when they can't negotiate https on subresoures, which ruins everyone's day. Older browsers are likely to require SHA1 certificates, and have a more limited selection of CAs. CA/Browser rules prohibit issuing new SHA-1 certificates, so you're pretty much out of luck there. Even if you can get a SHA-1 certificate that older browsers like, you have to also have a certificate that newer browsers like and get your server to distinguish between the two and serve the right certificate. Helpfully, Client Hello does not provide user-agent information, so you have to kind of guess at age of the browser / capability by what version, ciphers, and extensions they suggest. But really, all of that is moot unless you can get a trusted CA to issue a usable cert, which I'm pretty sure you can't.

Dalewyn 3y ago

I've only ever been inconvenienced by HTTPS/SSL 99% of the time because 99% of my browsing doesn't involve transmitting sensitive information like my credit cards. Passwords? I couldn't care less if someone were to waylay 99% of my passwords. For the remaining 1% HTTPS/SSL definitely serve a legitimate purpose, but as for the other 99% it's a fucking nuisance and I find websites that don't force the issue a breath of fresh air.

saagarjha 3y ago
I’d appreciate the password to your account then.

redder23 3y ago

Get ready for getting downvoted, these people want to get hacked! I made a comment about how unsecure it is to run a 20+ year old OS and I got downvoted. These people hate facts, just like on Reddit. They are so delusional they think some "sandbox" in the Browser that some dude ported back is fixing 20+ years of security holes in the OS, this is so funny.

OsrsNeedsf2P 3y ago
Depends on your threat model. Back in the real world, more users have been hacked by Windows 10's update system than running XP since 2020.
dang 3y ago
Can you please stop posting like this to HN? We have to ban accounts that do it, for reasons which should be clear if you review https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html. I don't want to ban you because you've also posted some good things, but we've already warned you once, and you've unfortunately been continuing to break the rules quite badly—not just in this thread but in others. To mention a couple recent examples: https://news.ycombinator.com/item?id=39467401 https://news.ycombinator.com/item?id=39467401 https://news.ycombinator.com/item?id=39458160 https://news.ycombinator.com/item?id=39458160 If this keeps up, we're going to have to ban you. If you'd please review https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and stick to the rules when posting here, we'd appreciate it.

toast0 3y ago

They do have SSL on the website, but it's optional. But assuming MITM, the only defense against MITM a site owner has is getting preloaded on the HSTS list. Refusing to serve content in HTTP doesn't help, because the MITM can upgrade the request on the backend. Redirecting from HTTP to HTTPS is window dressing. For a site like this, I might version sniff and send modern browsers to a favicon served over HTTPS with HSTS headers; future accesses will get upgraded to HTTPS (unless the MITM drops these requests), and older browsers don't understand HSTS anyway. But I wouldn't put that favicon on generally, because it's not likely possible to get a certificate older browsers will like, and older browsers like to throw popups when they can't negotiate https on subresoures, which ruins everyone's day. Older browsers are likely to require SHA1 certificates, and have a more limited selection of CAs. CA/Browser rules prohibit issuing new SHA-1 certificates, so you're pretty much out of luck there. Even if you can get a SHA-1 certificate that older browsers like, you have to also have a certificate that newer browsers like and get your server to distinguish between the two and serve the right certificate. Helpfully, Client Hello does not provide user-agent information, so you have to kind of guess at age of the browser / capability by what version, ciphers, and extensions they suggest. But really, all of that is moot unless you can get a trusted CA to issue a usable cert, which I'm pretty sure you can't.