13 ms·

I run my blog in unencrypted HTTP/1.1 just to make a point that we do not have to depend on third parties to publish content online. And I noticed that Whatsap

I run my blog in unencrypted HTTP/1.1 just to make a point that we do not have to depend on third parties to publish content online. And I noticed that Whatsapp is even worse than Chrome, it opens HTTPS even if I share HTTP links.

deleted 1y ago
[deleted]
1vuio0pswjnm7 1y ago
That's a good point to make, IMHO What is funny about HTTPS is that early arguments for its existence IIRC were often along the lines of protecting credit card numbers and personal information that needed to be sent during e-commerce HTTPS may have delivered on this promise. Of course HTTPS is needed for e-commerce. But not all web use is commercial transactions Today, it's unclear who or what^2 HTTPS is really protecting anymore For example, - web users' credit card numbers are widely available, sold on black markets to anyone; "data breaches" have become so common that few people ask why the information was being collected and stored in the first place nor do they seek recourse - web users' personal information is routinely exfiltrated during web use that is not e-commerce, often to be used in association with advertising services; perhaps the third parties conducting this data collection do not want the traffic to be optionally inspected by web users or competitors in the ad services business - web users' personal information is shared from one third party to another, e.g., to "data brokers", who operate in relative obscurity, working against the interests of the web users All this despite "widespread use of encryption", at least for data in transit, where the encryption is generally managed by third parties When the primary use of third-party mediated HTTPS is to protect data collection, telemetry, surveillance and ad services delivery,^1 it is difficult for me to accept that HTTPS as implemented is primarily for protecting web users. It may benefit some third parties financially, e.g., CA and domainname profiteers, and it may protect the operations of so-called "tech" companies though Personal information and behavioral data are surreptitiously exfiltrated by so-called "tech" companies whilst the so-called "tech" company's "secrets", e.g., what data they collect, generally remain protected. The companies deal in information they do not own yet operate in secrecy from its owners, relentlessly defending against any requests for transparency 1. One frequent argument for the use of HTTPS put forth by HN commenters has been that it prevents injection of ads into web pages by ISPs. Yet the so-called "tech" companies are making a "business" out of essentially the same thing: injecting ads, e.g., via real-time auctions, into web pages. It appears to this reader that in this context HTTPS is protecting the "business" of the so-called "tech" companies from competition by ISPs. Some web users do not want _any_ ads, whether from ISPs or so-called "tech" companies 2. I monitor all HTTPS traffic over the networks I own using a local forward proxy. There is no plaintext HTTP traffic leaving the network unless I permit it for a specific website in the proxy config. The proxy forces all traffic over HTTPS If HTTPS were optionally under user control, certainly I would be monitoring HTTPS traffic being automatically sent from own computers on own network to Google by Chrome, Android, YouTube and so on. As I would for all so-called "tech" companies doing data collection, surveillance and/or ad services as a "business" Ideally one would be able to make an informed decision whether they want to send certain information to companies like Google. But as it stands, with the traffic sometimes being protected from inspection _by the computer owner_, through use of third party-mediated certificates, the computer owner is prevented from knowing what information is being sent In own case, that traffic just gets blocked
- 1vuio0pswjnm7 1y ago
  O5QXGIBLGEQHI2DFNYQGI33XNYQHI2DFNYQHK4BAORUGK3RAMRXXO3QK
bruce511 1y ago
I applaud you for your principled stance. And of course this change in Chrome changes nothing wrt your ability to continue doing this. Equally your preference for HTTP should not stand in the way of a more secure default for the average person. Honestly I'd prefer that my mom didn't browse any http sites, it's just safer that way. But that doesn't detract from your ability to serve unencrypted pages which can easily be intercepted or modified by an ISP (or worse.)
throawayonthe 1y ago
why not make the point with at least a self signed cert?
- bell-cot 1y ago
  99% of visitors wouldn't get the intended point - they'd think he's pro-cert, but forgot to renew it or something.
  - DaSHacka 1y ago
    Honestly I don't even think technical users would get the 'point' most of the time. Whenever I visit a HTTP-only site, I assume the administrator is either old and does not understand how to set up SSL, or it's an unmaintained/forgotten web server that hasn't been touched in about a decade.
    - bell-cot 1y ago
      > When ... I assume the ... If it's (1) obviously recent content*, and (2) something that needs little security - a city council member's blog, or recipes - then how much do you care that it's HTTP-only? *Or just date-insensitive
      - mpeg 1y ago
        That's precisely the point of HTTPS, your harmless recipe site can start spreading malware without your knowledge if you make it HTTP, as the content can be changed by anyone it passes through.
        bell-cot 1y ago
        > your harmless recipe site can ... As can every recipe site with httpS - but a vulnerable WordPress plugin, or too-easy admin password, or malvertising, or a zillion other things. But conveniently, "all sites gotta be httpS" puts the biggest part of the blame/load on the littlest little guys - who want to make and post good, unmonetized content. But don't have an IT skill set, nor want to deal with yet more admin overhead & costs.
dinkelberg 1y ago
Would you tolerate using DANE?
Too 1y ago
So instead of depending on one third party, you now depend on every Hotel, ISP and Cafe on the planet. Great compromise.
eadmund 1y ago
> I noticed that Whatsapp is even worse than Chrome, it opens HTT PS even if I share HTTP links. Firefox does this when I type in a URL and the server is down. I absolutely hate this behaviour, because I run a bunch of services inside my network. If I tell my browser ‘fetch http://site.example http://site.example,’ I mean for it to connect to site.example on HTTP on port 80 nothing more. If there is a web server run ning which wants to redirect me to https://site.example https://site.example, awesome, but my browser should never assume I mean anything I did not say.)
- dang 1y ago
  Sorry for the offtopicness but could you please email hn@ycombinator.com so I can explain why your comment only appeared here 14 hours after you tried 9 times to post it? :)
shadowgovt 1y ago
Doesn't that mean that technically, any node in the network between you and your reader can mutate the contents of the blog in-transit without anyone being the wiser (up to and including arbitrary JavaScript inline injection)? Probably a low-threat security risk for a blog.
- bawolff 1y ago
  For a blog, i think the bigger risk is pervasive surveilence - gov reads all the connections and puts you on a list if the thing you are reading has the wrong keyword in it.
- bsilvereagle 1y ago
  Yes, hotels were injecting ads on their free WiFi - https://news.ycombinator.com/item?id=3804608 https://news.ycombinator.com/item?id=3804608
  - riffic 1y ago
    ISPs have been known to do the same thing.
    - Ferret7446 1y ago
      Devil's advocate, but maybe ISPs should all inject ads to make a point. They make money, and anyone using HTTP gets taught a free lesson on what MITM means
      - sam_lowry_ 1y ago
        Before turning on the dude who thrives to keep the internet free, fix your corporate laptop that does MITM even for HTTPS connections.
        01HNNWZ0MV43FF 1y ago
        I own a personal laptop?
Ajedi32 1y ago
Do you depend on a DNS root server to map your website name to your IP address? That's a third party. There are ways to remove that dependency, but it's going to involve a decentralized DNS replacement like Namecoin or Handshake, many of which include their own built-in alternatives to the CA system too so if "no third parties" is something you truly care about you can probably kill two birds with one stone here.
- cube00 1y ago
  Registrar is the big one, if yours decides to do a Google and randomly ban you and automatically decline your appeal with AI, you're stuffed.
  - tracker1 1y ago
    This is generally my biggest concern. Not that I'm doing anything shady, I've wanted to setup a potentially politically charged site in the past.
vhcr 1y ago
Depend on one less third party, you still depend on the DNS Root servers, your ISP / hosting, domain registry, etc.
- michaelt 1y ago
  CAs are uniquely assertive about their right to cut off your access. My hosting provider may accidentally fuck up, but they'll apologise and fix it. My CA fucks up, they e-mail me at 7pm telling me I've got to fix their fuck-up for them by jumping through a bunch of hoops they have erected, and they'll only give me 16 hours to do it. Of course, you might argue my hosting provider has a much higher chance of fucking up....
  - Uvix 1y ago
    CAs have to follow the baseline rules set by Google and Mozilla regarding incident response timelines. If they gave you more time, the browsers would drop them as a supported CA.
    - michaelt 1y ago
      The CAs have to follow the baseline rules set by the CA/Browser Forum which CAs are voting members of. Mark my words, some day soon an enterprising politician will notice the CA system can be drawn into trade sanctions against the enemy of the day....
      - tialaramex 1y ago
        The BRs already have a deliberate carve out where a CA can notify that their government requires them to break the rules and how they'll do that, and then the browsers, on behalf of relying parties can take whatever action they deem appropriate. If you're required to (or choose to) not tell us about it, because of active monitoring when we notice it's likely your CA will be distrusted for not telling us, this is easier because there's a mechanism to tell us about it - same way that there's a way to officially notify the US that you're a spy, so, when you don't (because duh you're a spy) you're screwed 'cos you didn't follow the rules. The tech centralization under the US government does mean there's a vulnerability on the browser side, but I wouldn't speculate about how long that would last if there's a big problem.
kevstev 1y ago
There are dozens of us I guess that care about this kind of thing. I have never really understood the obsession with https for static content that I don't care if anyone can see I am reading like a blog post. HTTPS should be for things that matter, everything else can, and think should use HTTP when it is not necessary. Depending on yet another third party to provide what is IMHO a luxury should not be required, and I have been continually confused as to why it is being forced down everyone's throat.
- derf_ 1y ago
  >There are dozens of us I guess... Shine on you crazy diamond, and all that, but... > I have been continually confused as to why it is being forced down everyone's throat. Have you never sat on public wifi and tried to open an http site? These days it is highly likely to be MITM'd by the wifi provider to inject ads (or worse). Even residential ISPs that one pays for cannot be trusted not to inject content, if given the opportunity, because they noticed that they are monopolies and most users cannot do anything about it. You don't get to choose the threat model of those who visit your site.
  - sam_lowry_ 1y ago
    Have you ever opened your work laptop? It is likely MITM'd so that your employer can see everything you read and post on the internet and HTTPS won't help you.
    - DaSHacka 1y ago
      So? I own more devices than a work laptop. I would like to have privacy and security on those.
  - varjag 1y ago
    Have you never sat on public wifi and tried to open an http site? These days it is highly likely to be MITM'd by the wifi provider to inject ads (or worse). I honestly don't remember a single case where that happened to me. Internet user since 1997.
- 1y ago
deepsun 1y ago
Yea, but then every time I open your blog, all the middle-men receive some metadata about my device/browser/language etc, that helps to fingerprint my activity online.
bullen 1y ago
I made this to redirect HTTPS to HTTP with whatsapp: https://multiplayeronlinestandard.com/goto.html https://multiplayeronlinestandard.com/goto.html (the reason for the domain is I will never waste time on HTTPS but github does it automatically for free up to 100GB/month)

deleted 1y ago

[deleted]

1vuio0pswjnm7 1y ago

That's a good point to make, IMHO What is funny about HTTPS is that early arguments for its existence IIRC were often along the lines of protecting credit card numbers and personal information that needed to be sent during e-commerce HTTPS may have delivered on this promise. Of course HTTPS is needed for e-commerce. But not all web use is commercial transactions Today, it's unclear who or what^2 HTTPS is really protecting anymore For example, - web users' credit card numbers are widely available, sold on black markets to anyone; "data breaches" have become so common that few people ask why the information was being collected and stored in the first place nor do they seek recourse - web users' personal information is routinely exfiltrated during web use that is not e-commerce, often to be used in association with advertising services; perhaps the third parties conducting this data collection do not want the traffic to be optionally inspected by web users or competitors in the ad services business - web users' personal information is shared from one third party to another, e.g., to "data brokers", who operate in relative obscurity, working against the interests of the web users All this despite "widespread use of encryption", at least for data in transit, where the encryption is generally managed by third parties When the primary use of third-party mediated HTTPS is to protect data collection, telemetry, surveillance and ad services delivery,^1 it is difficult for me to accept that HTTPS as implemented is primarily for protecting web users. It may benefit some third parties financially, e.g., CA and domainname profiteers, and it may protect the operations of so-called "tech" companies though Personal information and behavioral data are surreptitiously exfiltrated by so-called "tech" companies whilst the so-called "tech" company's "secrets", e.g., what data they collect, generally remain protected. The companies deal in information they do not own yet operate in secrecy from its owners, relentlessly defending against any requests for transparency 1. One frequent argument for the use of HTTPS put forth by HN commenters has been that it prevents injection of ads into web pages by ISPs. Yet the so-called "tech" companies are making a "business" out of essentially the same thing: injecting ads, e.g., via real-time auctions, into web pages. It appears to this reader that in this context HTTPS is protecting the "business" of the so-called "tech" companies from competition by ISPs. Some web users do not want _any_ ads, whether from ISPs or so-called "tech" companies 2. I monitor all HTTPS traffic over the networks I own using a local forward proxy. There is no plaintext HTTP traffic leaving the network unless I permit it for a specific website in the proxy config. The proxy forces all traffic over HTTPS If HTTPS were optionally under user control, certainly I would be monitoring HTTPS traffic being automatically sent from own computers on own network to Google by Chrome, Android, YouTube and so on. As I would for all so-called "tech" companies doing data collection, surveillance and/or ad services as a "business" Ideally one would be able to make an informed decision whether they want to send certain information to companies like Google. But as it stands, with the traffic sometimes being protected from inspection _by the computer owner_, through use of third party-mediated certificates, the computer owner is prevented from knowing what information is being sent In own case, that traffic just gets blocked

1vuio0pswjnm7 1y ago
O5QXGIBLGEQHI2DFNYQGI33XNYQHI2DFNYQHK4BAORUGK3RAMRXXO3QK

bruce511 1y ago

I applaud you for your principled stance. And of course this change in Chrome changes nothing wrt your ability to continue doing this. Equally your preference for HTTP should not stand in the way of a more secure default for the average person. Honestly I'd prefer that my mom didn't browse any http sites, it's just safer that way. But that doesn't detract from your ability to serve unencrypted pages which can easily be intercepted or modified by an ISP (or worse.)

throawayonthe 1y ago

why not make the point with at least a self signed cert?

bell-cot 1y ago
99% of visitors wouldn't get the intended point - they'd think he's pro-cert, but forgot to renew it or something.
- DaSHacka 1y ago
  Honestly I don't even think technical users would get the 'point' most of the time. Whenever I visit a HTTP-only site, I assume the administrator is either old and does not understand how to set up SSL, or it's an unmaintained/forgotten web server that hasn't been touched in about a decade.
  - bell-cot 1y ago
    > When ... I assume the ... If it's (1) obviously recent content*, and (2) something that needs little security - a city council member's blog, or recipes - then how much do you care that it's HTTP-only? *Or just date-insensitive
    - mpeg 1y ago
      That's precisely the point of HTTPS, your harmless recipe site can start spreading malware without your knowledge if you make it HTTP, as the content can be changed by anyone it passes through.
      - bell-cot 1y ago
        > your harmless recipe site can ... As can every recipe site with httpS - but a vulnerable WordPress plugin, or too-easy admin password, or malvertising, or a zillion other things. But conveniently, "all sites gotta be httpS" puts the biggest part of the blame/load on the littlest little guys - who want to make and post good, unmonetized content. But don't have an IT skill set, nor want to deal with yet more admin overhead & costs.

dinkelberg 1y ago

Would you tolerate using DANE?

Too 1y ago

So instead of depending on one third party, you now depend on every Hotel, ISP and Cafe on the planet. Great compromise.

eadmund 1y ago

> I noticed that Whatsapp is even worse than Chrome, it opens HTT PS even if I share HTTP links. Firefox does this when I type in a URL and the server is down. I absolutely hate this behaviour, because I run a bunch of services inside my network. If I tell my browser ‘fetch http://site.example http://site.example,’ I mean for it to connect to site.example on HTTP on port 80 nothing more. If there is a web server run ning which wants to redirect me to https://site.example https://site.example, awesome, but my browser should never assume I mean anything I did not say.)

dang 1y ago
Sorry for the offtopicness but could you please email hn@ycombinator.com so I can explain why your comment only appeared here 14 hours after you tried 9 times to post it? :)

shadowgovt 1y ago

Doesn't that mean that technically, any node in the network between you and your reader can mutate the contents of the blog in-transit without anyone being the wiser (up to and including arbitrary JavaScript inline injection)? Probably a low-threat security risk for a blog.

bawolff 1y ago
For a blog, i think the bigger risk is pervasive surveilence - gov reads all the connections and puts you on a list if the thing you are reading has the wrong keyword in it.
bsilvereagle 1y ago
Yes, hotels were injecting ads on their free WiFi - https://news.ycombinator.com/item?id=3804608 https://news.ycombinator.com/item?id=3804608
- riffic 1y ago
  ISPs have been known to do the same thing.
  - Ferret7446 1y ago
    Devil's advocate, but maybe ISPs should all inject ads to make a point. They make money, and anyone using HTTP gets taught a free lesson on what MITM means
    - sam_lowry_ 1y ago
      Before turning on the dude who thrives to keep the internet free, fix your corporate laptop that does MITM even for HTTPS connections.
      - 01HNNWZ0MV43FF 1y ago
        I own a personal laptop?

Ajedi32 1y ago

Do you depend on a DNS root server to map your website name to your IP address? That's a third party. There are ways to remove that dependency, but it's going to involve a decentralized DNS replacement like Namecoin or Handshake, many of which include their own built-in alternatives to the CA system too so if "no third parties" is something you truly care about you can probably kill two birds with one stone here.

cube00 1y ago
Registrar is the big one, if yours decides to do a Google and randomly ban you and automatically decline your appeal with AI, you're stuffed.
- tracker1 1y ago
  This is generally my biggest concern. Not that I'm doing anything shady, I've wanted to setup a potentially politically charged site in the past.

vhcr 1y ago

Depend on one less third party, you still depend on the DNS Root servers, your ISP / hosting, domain registry, etc.

michaelt 1y ago
CAs are uniquely assertive about their right to cut off your access. My hosting provider may accidentally fuck up, but they'll apologise and fix it. My CA fucks up, they e-mail me at 7pm telling me I've got to fix their fuck-up for them by jumping through a bunch of hoops they have erected, and they'll only give me 16 hours to do it. Of course, you might argue my hosting provider has a much higher chance of fucking up....
- Uvix 1y ago
  CAs have to follow the baseline rules set by Google and Mozilla regarding incident response timelines. If they gave you more time, the browsers would drop them as a supported CA.
  - michaelt 1y ago
    The CAs have to follow the baseline rules set by the CA/Browser Forum which CAs are voting members of. Mark my words, some day soon an enterprising politician will notice the CA system can be drawn into trade sanctions against the enemy of the day....
    - tialaramex 1y ago
      The BRs already have a deliberate carve out where a CA can notify that their government requires them to break the rules and how they'll do that, and then the browsers, on behalf of relying parties can take whatever action they deem appropriate. If you're required to (or choose to) not tell us about it, because of active monitoring when we notice it's likely your CA will be distrusted for not telling us, this is easier because there's a mechanism to tell us about it - same way that there's a way to officially notify the US that you're a spy, so, when you don't (because duh you're a spy) you're screwed 'cos you didn't follow the rules. The tech centralization under the US government does mean there's a vulnerability on the browser side, but I wouldn't speculate about how long that would last if there's a big problem.

kevstev 1y ago

There are dozens of us I guess that care about this kind of thing. I have never really understood the obsession with https for static content that I don't care if anyone can see I am reading like a blog post. HTTPS should be for things that matter, everything else can, and think should use HTTP when it is not necessary. Depending on yet another third party to provide what is IMHO a luxury should not be required, and I have been continually confused as to why it is being forced down everyone's throat.

derf_ 1y ago
>There are dozens of us I guess... Shine on you crazy diamond, and all that, but... > I have been continually confused as to why it is being forced down everyone's throat. Have you never sat on public wifi and tried to open an http site? These days it is highly likely to be MITM'd by the wifi provider to inject ads (or worse). Even residential ISPs that one pays for cannot be trusted not to inject content, if given the opportunity, because they noticed that they are monopolies and most users cannot do anything about it. You don't get to choose the threat model of those who visit your site.
- sam_lowry_ 1y ago
  Have you ever opened your work laptop? It is likely MITM'd so that your employer can see everything you read and post on the internet and HTTPS won't help you.
  - DaSHacka 1y ago
    So? I own more devices than a work laptop. I would like to have privacy and security on those.
- varjag 1y ago
  Have you never sat on public wifi and tried to open an http site? These days it is highly likely to be MITM'd by the wifi provider to inject ads (or worse). I honestly don't remember a single case where that happened to me. Internet user since 1997.
1y ago

deepsun 1y ago

Yea, but then every time I open your blog, all the middle-men receive some metadata about my device/browser/language etc, that helps to fingerprint my activity online.

bullen 1y ago

I made this to redirect HTTPS to HTTP with whatsapp: https://multiplayeronlinestandard.com/goto.html https://multiplayeronlinestandard.com/goto.html (the reason for the domain is I will never waste time on HTTPS but github does it automatically for free up to 100GB/month)