11 ms·
This is a dumb idea unless CAs becomes automatic and free or are completely replaced by something better. The reason why HTTPS isn't used more is because it's
by kristofferR 13y ago
This is a dumb idea unless CAs becomes automatic and free or are completely replaced by something better.
The reason why HTTPS isn't used more is because it's a major hassle and it's quite expensive (can easily double the yearly cost for smaller sites).
If using HTTP 2.0 requires buying SSL certificates, the smaller sites currently not using SSL will just be stuck on HTTP 1.1 forever.
- dchest 13y agothe smaller sites currently not using SSL will just be stuck on HTTP 1.1 forever Is it a problem?
- esolyt 13y agoI don't think so. We are also "stuck" on IPv4 which hasn't been a problem.
- josteink 13y agoSaying that you can only use this new technology if you are willing to hand out $100 a year to some third party provider which you really don't see the need for is a major hindrance to adoption. Imagine if every former "free" technology (tcp/ip, email, http, c-compiler, whatever) demanded you pay $100 annually to use it. How many hackers creating things which we now take for granted do you think would have been discouraged from doing just so? Security is nice, but that doesn't mean it's worth it or required all over, at any cost. De-facto requiring a paid "license" to operate on the internet is not the right way to go.
- hrktb 13y agoIf you think it as something similar to DNS it's not so shocking. Right now we are handing cash to get a usable domain name, or ask some other entity to share a space on their domains. Now you'll also pay for you SSL certificate or ask some other entity to let you share a piece of theirs.
- dchest 13y agoThere's nothing in this technology that demands payment. You can distribute your own root certificate to clients, or create a free certification authority (or join http://www.cacert.org/ http://www.cacert.org/), if you'd like.
- pilif 13y agoWhat are you running your web servers on? How do you connect these web servers to the internet? How do you register your domain? I would assume that you pay more than $100/y (which is expensive for a domain validated SSL cert, btw) unless you're using a free hosting provider at which point it's not your decision what protocol to use anyways.
- josteink 13y agoI have 10mbps upstream connection. I have a Raspberry pi and a Linux-powered NAS. I have lots of equipment which costs me nothing to use, which I can use to host or create new internet services. And I do. No, it wont let me run a multi-million user site, but that's not my aim, nor should it be needed to let people new at the game fool around. Putting the bar higher and higher to just being able to fool around is so utterly the wrong way to go. I wonder if anyone on this site remembers what is was like to be 8 years old and already being able to program your first program on your TRS-80 or Commodore 64. No money needing to be spent, no need to seek permission. Just hack. Get immediate, direct feedback. Instantly gratifying. That appraoch gave us a generation of computer-professionals unlike any other. Why are we so eager to put the road-blocks on now?
- dchest 13y agoGet immediate, direct feedback. Instantly gratifying. That appraoch gave us a generation of computer-professionals unlike any other. Are you kidding? Just a few decades ago you would need to pay a lot for machine time to be able to use computer. Today you can sit near a cafe with a $200 netbook and have a free internet access. In the 90's a .com domain cost ~$100. Just a few years ago TLS certificate cost close to the hundred, today you can buy one at around $10 per year or sometimes get it for free. You have 10mbps connection! At your home! How much do you pay for it?
- josteink 13y agoGet over my connection. Some places it's quite common. The thing is you are both missing the point: The tech landscape is growing increasingly complex. We shouldn't be adding more obstacles to getting involved than we already have. That's how horrible Legacy-things get built. We don't need to do that to our internet.
- stephen_g 13y agoYou can get free SSL certificates from StartSSL. There are also domain registrars who give you a certificate with domains you buy for no extra cost, and other CAs which are less than $10 a year. And if none of those float your boat, you can always self sign if your willing to put up with the warning messages. Your argument seems extremely hyperbolic.
- guilloche 13y agoCannot agree more. Besides $100 annually, a CA certificate is harder to manage (considering cloud hosting etc.), and it is not worth doing for many casual sites. I predict that https only http/2 will be doomed.
- nwh 13y agoUnless there's somewhere that will let me do domain-only validation, I'm not interested in it either. Sick of places leaking my information that has been "secured".
- blackdogie 13y agoOne service I can recommend is https://www.startssl.com/ https://www.startssl.com/ (no affiliation, just a customer) who offer free certs to individuals , and cheaper certs to businesses (their prices on wildcard certs and multiple domain certs are they best I've seen online $59).
- pezz 13y agoAs an individual, can I just say -- don't ever mess up, lose your key or need to regenerate your certificate before the expiry date. Live within their means, or it will cost you $25 (because of "revocation costs"). StartCom are pretty awesome, but be aware of potential pitfalls.
- LinaLauneBaer 13y agoI had to revoke my wildcard cert a few weeks ago. You can tell them why you did that. As far I know they decide to charge you on a case by case basis. When I revoked my cert I got an email 3 minutes later saying: "Revoked free of charge".
- pezz 13y agoNot my experience at all. To quote them: "Class 1 certificates aren't revoked free because we receive too many requests daily (specially for the Class 1 free certs) and would we have revoked them all, our certificate revocation list (CRL) would have been blown out of every proportion." In a further back-and-forth, the admin proceeded to tell me how much bandwidth I would cause them (I don't even care about being added to a CRL for a personal domain). Edit: Sorry, you did say a wildcard cert, which sounds like a paid cert, so would offer more "service" I'm guessing.
- techsupporter 13y agoTheir verification service is annoyingly rigid. Anything other than a phone call to a number listed on a phone bill (and no fair blacking out other numbers on a family plan, for instance) or waiting a couple of weeks for a letter from Israel is rejected, even when the information is easily verified using online government databases[1]. 1 - Not an NSA joke, more that "hey, voter registration and property tax rolls are public and online; you could just verify that, no?"
- johndoeee 13y agoThe first proposal doesn't require you to buy a certificate, see: http://tools.ietf.org/html/draft-nottingham-http2-encryption-00#appendix-D.2 http://tools.ietf.org/html/draft-nottingham-http2-encryption... With that http will be encrypted with no certificate check and https will still have the good 'ol check.
- noir_lord 13y agoThe irony is that in that situation http with ssl and a randomly generated cert will be more secure than HTTPS which uses the CA's Cert, hell I'd like the HTTPS to use the CA's cert for identity but use a self-signed cert for actual data transfers. CA's are a single point of failure for security.
- Sae5waip 13y agoDon't worry, you just don't understand how TLS works :-) The CA never gets the private key. Instead they get a certificate signing request (CSR), which only contains the public key part. They sign that. Oh, and then there is perfect forward secrecy, which basically means that even the servers private key is not the one used to encrypt the actual data (after the initial handshaking, and only for suitable cipher suites, subject to downgrade attacks). Disclaimer: at least, thats how its properly done. Some CAs offer a "send us your cert and we'll sign it", and dumb people who shouldn't be admins use it because it's (slightly) easier to use. But you got the conclusion right, the notion of CAs is problematic.
- novaleaf 13y agoexcept that the CA or CA hacker can impersonate you, thus it's still one of the multiple single points of failure
- icebraining 13y agoYes, but they can also do so if you use a self-signed certificate, by just self-signing their own. There's no way that's less secure than a CA-signed cert.
- kijin 13y agoI recently bought a PositiveSSL certificate for less than $3 per year at gogetssl.com. That's less than one third of what I paid for the domain to use it on. If you can afford a domain, you can afford to put a SSL certificate on it. Low-cost SSL brands like PositiveSSL and RapidSSL are so cheap nowadays, some registrars hand them out for free if you buy a domain. And they're compatible with every version of IE on Windows XP, unlike those free certs from StartSSL.
- mtrimpe 13y agoAnd what about wildcard certificates?
- kijin 13y agoThe good ol' Subdomain-versus-Subfolder debate just gets a bit more expensive on the left side, that's all. Services that really need an unlimited number of subdomains are a tiny minority, and market prices reflect this. For the time being, someone like WordPress.com can probably afford $60-$100/year for a wildcard certificate. Everyone else just sticks to subfolders like Twitter does. After all, nobody will be preventing you from running a website. Your priorities and economic circumstances might prevent you from using pretty subdomains, but that's no different from the current reality where short and memorable dot-com domains cost thousands of dollars.
- pixelcort 13y agoThe cost usually isn't so much the cost of the cert, it's more the cost of the static IP.
- rwmj 13y agoThey should just do what ssh does.
- api 13y agoHere's a suggestion: http:// http:// is encrypted but performs NO certificate check. https:// https:// is encrypted but performs a certificate check. Done.
- mtgx 13y agoI think complacency and thinking "they don't need it", even if it costs a few extra dollars a year, is the much bigger problem. Some sites may stick with 1.1 for a while, but my guess is there will be a ton more sites who will be adopting HTTPS because of this.
- fulafel 13y agoWhy is this the top comment, didn't anybody read the link? Come on, HN! (hint: in most of the design options there wouldn't be CAs unless you used the https url scheme. See other messages in the linked thread too)
- chrisfarms 13y agoThe encryption of the transport and the verification of the identity of the server should be more disconnected. The CA part is only to verify that the machine you are talking to is who it says it is.... in reality all this really verifies is that they filled out a form and there is probably a money trial somewhere leading to a real entity. But I've never understood why the identity is so tied to the transport security. It would make everyone's life easier if HTTPS could be used WITHOUT identity verification (for 90% of cases this would make the world a better place) We'd still want to purchase third-party identify verification... and browsers would still present this in the same way ("green padlocks" etc)... but even without verification every connection could be encrypted uniquely, and it would raise the bar considerably for a great number of sniffing-based issues would it not? EDIT: I guess what I'm saying is a social issue: We've put so much effort into telling everyone that "HTTPS is totally secure", that we've left no room for a system that is "Mostly secure, unless someone has compromised the remote system/network" .... maybe it's too late to teach everyone the difference between "encrypting a letter" and "verifiying that the person you give the letter to is who they say they are"
- VLM 13y agoI'm sitting here still trying to think of a way to prevent MITM attacks if you have no idea who the guy is on the other side... Maybe I need to drink more tea this early in the morning? I guess if you did something weird like flip the protocol upside down such that all people would have "internet licenses" and enter them into the browser they're using at that moment (or better yet, lets charge each user $50/yr PER BROWSER LICENSE) and it became the sites problem to encrypt to the end users key... One way or another I think you have to verify the identity of at least one side WRT MITM?
- hcarvalhoalves 13y ago> I'm sitting here still trying to think of a way to prevent MITM attacks if you have no idea who the guy is on the other side... Maybe I need to drink more tea this early in the morning? It's not that you don't know who the guy is, you just don't rely on a 3rd party to tell you that. See how SSH fingerprinting works.
- agravier 13y agoDomain names will probably be sold in bundles with certificates, driving the price of SSL certificates lower.
- joeblau 13y agoTotally agree. While this sounds amazing, the process of maintaing certificates can be a nightmare especially to someone not familiar with the security process. On the other hand, this does present a huge opportunity for a service that would basically manage your companies certificates.
- gwu78 13y agoAs a client, it's easy to be your own CA. Then you can just obtain the remote server certificates you need and, if you trust those endpoints, sign them yourself. The problem is how to get those certificates and be sure they are the right ones. The problem was already solved in the pre-Internet world: letterhead, signatures and postal mail. Trustworthy commercial entities could really distribute their certificates in paper form (or maybe on a business card) as an official document. Customers then scan these into their computing devices and, if they choose, sign them. I doubt that anyone is pushing HTTPS based on the authentication function. It is the need for encryption that is probably the impetus.
- kunai 13y agoI hate to say it, but the W3C has been making quite a few dumb decisions lately.
- ollysb 13y agoSSL seems to conflate 2 ideas, proof of identity and an encryption layer. Would it be possible to have the encryption layer without requiring a third party to handle keys?