5 ms·

It says "Anonymous and secure", but I don't see HTTPS in the URL. When I prefix https:// https:// Firefox complains about untrusted certificate. Am I missing so

It says "Anonymous and secure", but I don't see HTTPS in the URL. When I prefix https:// https:// Firefox complains about untrusted certificate. Am I missing something?

josh_miller 14y ago
Sorry about that! I think the "Secure" copy is a bit misleading. We'll take that down. What we meant to communicate with "Anonymous and Secure" is, "Feel free to be completely honest because we won't show this information to anyone else, and we won't even ask for your name or identity!" It was a weekend project finished on little sleep. Sorry abou the "secure" bit.
- lucb1e 14y ago
  You can get free https certificates at https://startssl.com https://startssl.com On a first glance they don't look too high-tech and trustworthy, but for example https://lucb1e.com https://lucb1e.com seems to be valid in all browsers.
- MojoJolo 14y ago
  You're the Josh Miller from Branch right? Oh well, just clarifying. :) I admire you.
p4bl0 14y ago
The certificate being "untrusted" doesn't mean anything about security. It just mean that they have signed it themselves and that no central authorities that you are supposed to trust for whatever reasons has signed it for them. All you want here is an encrypted communication, and you get that with the self-signed certificate as well.
- halviti 14y ago
  Yes, you get encrypted communication all the way to the person intercepting your internet traffic, and they have an encrypted channel to the server they are relaying your traffic to. Security!
  - p4bl0 14y ago
    You are right, but it depends on your threat model, see my answer to eli.
    - memoryfault 14y ago
      Encrypted communication is not very useful if you aren't sure who you are communicating with. Using a self-signed cert greatly increases this uncertainty.
      - p4bl0 14y ago
        I would agree with you entirely if I had more reasons to transitively trust the root certificates authorities than to trust the people I believe are building the website, because in reality I don't know any of them. Certificate authority getting hacked and issuing trusted certificates to not trust worthy people have happened already. You may say that you still put more confidence in a certificate that is transitively trusted by those your browser and / or OS vendor chose for you, but why? The SSL certificate system as it is now is highly unsatisfactory to me. I would prefer something decentralized like the GPG trust network.
- eli 14y ago
  No. Without a trusted authority or some other means to verify that the self-signed certificate is indeed coming from the site, there is effectively no security because it is trivial to launch a MITM attack.
  - p4bl0 14y ago
    For some definition of trivial. But you're right, it's not that simple (see below¹, I need to rant first). It's just that it upset me so much each time Firefox (or whatever browser, they all do it) load a webpage with a self-signed certificate and it acts like if I was attacked and my security is compromised or something… It's not worse than HTTP without SSL so why make me click two times like if I don't know what I'm doing? Nowadays it's more easy to do phishing in plain HTTP than in HTTPS: it's stupid. ¹ Actually it depends on your threat-model. If you assume that the first time you connect to the site there is no MITM (like we all do with SSH connections, don't tell me you always double check the fingerprint of the box you are SSHing to for the first time ;-)), then it is okay to trust the certificate as long as it doesn't change. EDIT: formating
    - eli 14y ago
      Sorry, but I think Firefox is doing exactly the right thing (by default) here. If you want it to do something else, I'd imagine there's a setting you can override somewhere. In practice it is worse than no SSL because it provides a false sense of security to users who have been trained that HTTPS = secure.

It says "Anonymous and secure", but I don't see HTTPS in the URL. When I prefix https:// https:// Firefox complains about untrusted certificate. Am I missing something?

josh_miller 14y ago

Sorry about that! I think the "Secure" copy is a bit misleading. We'll take that down. What we meant to communicate with "Anonymous and Secure" is, "Feel free to be completely honest because we won't show this information to anyone else, and we won't even ask for your name or identity!" It was a weekend project finished on little sleep. Sorry abou the "secure" bit.

lucb1e 14y ago
You can get free https certificates at https://startssl.com https://startssl.com On a first glance they don't look too high-tech and trustworthy, but for example https://lucb1e.com https://lucb1e.com seems to be valid in all browsers.
MojoJolo 14y ago
You're the Josh Miller from Branch right? Oh well, just clarifying. :) I admire you.

p4bl0 14y ago

The certificate being "untrusted" doesn't mean anything about security. It just mean that they have signed it themselves and that no central authorities that you are supposed to trust for whatever reasons has signed it for them. All you want here is an encrypted communication, and you get that with the self-signed certificate as well.

halviti 14y ago
Yes, you get encrypted communication all the way to the person intercepting your internet traffic, and they have an encrypted channel to the server they are relaying your traffic to. Security!
- p4bl0 14y ago
  You are right, but it depends on your threat model, see my answer to eli.
  - memoryfault 14y ago
    Encrypted communication is not very useful if you aren't sure who you are communicating with. Using a self-signed cert greatly increases this uncertainty.
    - p4bl0 14y ago
      I would agree with you entirely if I had more reasons to transitively trust the root certificates authorities than to trust the people I believe are building the website, because in reality I don't know any of them. Certificate authority getting hacked and issuing trusted certificates to not trust worthy people have happened already. You may say that you still put more confidence in a certificate that is transitively trusted by those your browser and / or OS vendor chose for you, but why? The SSL certificate system as it is now is highly unsatisfactory to me. I would prefer something decentralized like the GPG trust network.
eli 14y ago
No. Without a trusted authority or some other means to verify that the self-signed certificate is indeed coming from the site, there is effectively no security because it is trivial to launch a MITM attack.
- p4bl0 14y ago
  For some definition of trivial. But you're right, it's not that simple (see below¹, I need to rant first). It's just that it upset me so much each time Firefox (or whatever browser, they all do it) load a webpage with a self-signed certificate and it acts like if I was attacked and my security is compromised or something… It's not worse than HTTP without SSL so why make me click two times like if I don't know what I'm doing? Nowadays it's more easy to do phishing in plain HTTP than in HTTPS: it's stupid. ¹ Actually it depends on your threat-model. If you assume that the first time you connect to the site there is no MITM (like we all do with SSH connections, don't tell me you always double check the fingerprint of the box you are SSHing to for the first time ;-)), then it is okay to trust the certificate as long as it doesn't change. EDIT: formating
  - eli 14y ago
    Sorry, but I think Firefox is doing exactly the right thing (by default) here. If you want it to do something else, I'd imagine there's a setting you can override somewhere. In practice it is worse than no SSL because it provides a false sense of security to users who have been trained that HTTPS = secure.