7 ms·

My gut says that they've disabled SSL v2/v3, and that the device does not support TLS.

kogir 12y ago
I'd love to see the results from visiting the Qualys SSL Client Test: https://www.ssllabs.com/ssltest/viewMyClient.html https://www.ssllabs.com/ssltest/viewMyClient.html I imagine the issue is that we only support TLS 1.0+ and not SSLv2 or SSLv3. https://www.ssllabs.com/ssltest/analyze.html?d=news.ycombinator.com https://www.ssllabs.com/ssltest/analyze.html?d=news.ycombina...
- yuhong 12y ago
  I just tried it using IE6 with TLS 1.0 disabled and it does not load at all. If you watch the video carefully you will see the certificate errors that comes from the device having such an old certificate store too (in the case of google.com they now use GeoTrust with a cross certificate to Equifax). And I doubt the device support SHA256 certificates either. The device might not support the 3DES cipher suite either (as it was relatively slow compared to RC4) and many sites have disabled RC4.
Animats 12y ago
Security Theater Everywhere strikes again. Unless you're logged in and entering data, Hacker News does not need SSL.
- geofft 12y ago
  So I should take it that you're OK with every country's intelligence agency modifying links on HN for their citizens, redirecting crypto downloads to trojaned pages for specific users, suppressing links that are overly critical of the government, right?
  - Animats 12y ago
    Protection against changes should be done with subresource integrity hashes (http://www.w3.org/TR/SRI/ http://www.w3.org/TR/SRI/). With HTTPS, an observer still knows who you're talking to, and since they can see how big the request and reply are, they can probably guess what you're looking at.
    - deleted 12y ago
      [deleted]
    - rgbrenner 12y ago
      SRI does not replace HTTPS. You say they can guess what you're looking at with HTTPS.. well if you use SRI without HTTPS, then they don't need to guess.. they absolutely know what you're looking at. Also, if they can change the page (which they can if it's over http), they can change the hash as well. Also, SRI is like 9 months old since the first draft... which means it does nothing for the visitor unless they are using the newest version of one of the major browsers.
    - geofft 12y ago
      I totally agree (although you need more than SRI, since you also need some way of signing the original content, but I'd love to see a full spec for this sort of thing). However, SSL is what we have right now that works. And I think, of the browsers that do support SRI (possibly in prerelease versions or behind feature flags), they require the page to be delivered over SSL anyway.
      - Animats 12y ago
        HTTPS is broken by content delivery networks who terminate SSL connections. HTTPS Everywhere makes the problem worse, by increasing load for static pages and breaking caches, forcing sites to use a content delivery network. Take a look at that HTTPS certificate that you think means you're talking to the site of your choice. If it says "cloudflare.com", "incapsula.com", "edgecastcdn.com", "palmwebservices.com", "cdnetworks.net", there is a man in the middle of your HTTPS connection. This is the case for at least 38,000 sites we know about. There are probably more. (The list: http://john-nagle.github.io/certscan/whoamitalkingto04.pdf http://john-nagle.github.io/certscan/whoamitalkingto04.pdf) HTTPS Everywhere was well-intentioned, but the people behind it didn't realize that high-volume use of HTTPS forced less secure use of HTTPS. That's why it's a form of security theater.
  - voidz 12y ago
    Are you sure that the agencies you speak of are not able to do this anyway? Even the Hong Kong Post Office has a place among the trusted CA's supplied by most vendors: not really necessary for everyone on the planet, I'd think. If even just one of those trusted CAs would or has become compromised, all bets are off. Which has already happened in the past anyway. So, how you defend "SSL everywhere".. I don't buy it. I feel more for what the commenter you responded to said, because your counter argument comes with a lot of assumptions that have more problematic implications. A false sense of being secure does seem much worse than knowing that most of the stuff you do is actually insecure to begin with. Plain text is not a bug. It's a feature! Cheesy, I know.
    - yourad_io 12y ago
      > A false sense of being secure does seem much worse than knowing that most of the stuff you do is actually insecure to begin with. It may feel so, but it certainly isn't. Some security (against anyone but the top 0.X% of "bad guys") is certainly better than no security (random script kiddie in your coffee shop injecting 0-days from exploit-db straight to your browser). And regarding the hopelessness of SSL/TLS - the CA problem exists and is pretty huge. But we know the solution[1]: it's called certificate pinning. When you control clients (Google/Chrom[e/ium]) can just pin your own certs/CA and refuse anything signed by the Hong Kong office. For the rest of us that don't, there's HSTS (to tell the browser to refuse http:// http:// redirects from a MiTM, overriding TLS altogether) and Public Key Pinning Extension (HPKP). They aren't very widely rolled out, but we're getting there. Test your browser here[2], you may be surprised. This all assumes that the user won't ignore the warnings when they come up, of course. Also it would protect you from your second visit onwards - if you're being MiTM'ed at your first attempt to grab a site with all the above bells and whistles, your browser doesn't know about the pinned stuff yet, so it is vulnerable to SSL stripping, etc. In short, it's certainly better than nothing (protecting you from 99%+ of bad guys) and we're slowly fixing it[3]. Don't let the man get you down. [1] Until we get to a proper, more distributed solution [2] https://projects.dm.id.lv/Public-Key-Pins_test https://projects.dm.id.lv/Public-Key-Pins_test [3] Shamefully slowly - TACK was proposed so long ago... https://news.ycombinator.com/item?id=4010711 https://news.ycombinator.com/item?id=4010711
- alfiedotwtf 12y ago
  > Unless you're logged in and entering data, Hacker News does not need SSL What about if you're in a country that likes to censor the news?
  - chrissnell 12y ago
    Why not create a non-SSL virtualhost? http://plain.news.ycombinator.com http://plain.news.ycombinator.com or similar.
    - oneeyedpigeon 12y ago
      Or just have each protocol do what it's supposed to, rather than redirecting one to another? In general, aren't advanced users supposed to like having the option to make their own decisions?
      - innocenat 12y ago
        Yeah. How many users (not power users) actually type https:// https:// into address bar? To my knowledge, if you don't include the protocol, browser default to HTTP.
        pizzeys 12y ago
        Not on Hacker News (and many other sites) with a modern browser. The first time you visit http://news.ycombinator.com http://news.ycombinator.com, it will redirect to https:// https://, and you're correct, if the first time you visit happens to be the time you are MITM'd, this is a weak point. However, after the first visit, your browser learns through HSTS (the Strict-Transport-Security header) that accessing news.ycombinator.com without TLS is not supported, and won't attempt to access it again except via TLS. (For a year, in HN's case - this is configurable by the site administrator.)
        vertex-four 12y ago
        Point is that your grandparent comment was suggesting that visiting http://news.ycombinator.com http://news.ycombinator.com should not redirect to HTTPS.
- ihodes 12y ago
  Instead of continuing the trend of downvoting you: Without SSL, you can't be sure of the integrity of the data set by the site. It's important even when not exchanging private data.
- acdha 12y ago
  If you were looking for MITM targets likely to have access to many interesting things, HN would be high on the lists of sites to intercept.
- deleted 12y ago
  [deleted]
- agwa 12y ago
  In addition to thwarting state-sponsored attacks mentioned by geofft, HTTPS also prevents ISPs and hotels from injecting ads[1,2]. And using HTTPS even for logged-out users prevents an attacker from sslstripping[3] the link to the login page, which is good because even the most careful users won't always notice when a login page is suddenly served over an insecure connection. As a user of HN, I appreciate these security features. Suggesting that HN should not use HTTPS so that someone can access it from a 10 year old device that's impractical for modern web browsing anyways is possibly the weakest argument you can make against HTTPS. [1] http://arstechnica.com/tech-policy/2013/04/how-a-banner-ad-for-hs-ok/ http://arstechnica.com/tech-policy/2013/04/how-a-banner-ad-f... [2] http://justinsomnia.org/2012/04/hotel-wifi-javascript-injection/ http://justinsomnia.org/2012/04/hotel-wifi-javascript-inject... [3] http://www.thoughtcrime.org/software/sslstrip/ http://www.thoughtcrime.org/software/sslstrip/
  - deleted 12y ago
    [deleted]
  - roywiggins 12y ago
    T-Mobile opted me in to a content filter by default. To remove it, last I saw I needed to give them my SSN (!!!). So, I live with the idiot filter, which actually scans for keywords in websites and blocks them. SSL obviously makes this sort of filtering useless, which is very useful.
    - CamperBob2 12y ago
      Wow. This is in the US, I assume ("SSN")? I've never heard of this happening with a US carrier.
      - ChristianBundy 12y ago
        Yeah, social security number. It's basically a private key we're all assigned at birth that can't be rotated. It was originally meant to be used in the state-sponsored welfare program "social security", but tons of businesses require it as a unique identifier. Absolute stupidity on all fronts.
- nailer 12y ago
  Firesheep would allow some guy at your coffee shop or conference to steal your user account. SSL would stop them.
- peterwwillis 12y ago
  The "security theater" comment probably got you downvoted because it seems like an insult against HN, when it's probably more of a general reflection that not all sites need HTTPS, which is a fact (some need to not have encryption, both legally and for functional reasons).
- mobiplayer 12y ago
  If you only encrypt what's important, you're doing your "enemies" half of their work :)
marcosscriven 12y ago
Same happened to me trying to use Safari Books Online on my Kindle browser (as the only official way yo access their content on an eInk display). They dropped SSLv3, and in doing so the old 'experimental' Kindle browser can no longer access it.

kogir 12y ago

I'd love to see the results from visiting the Qualys SSL Client Test: https://www.ssllabs.com/ssltest/viewMyClient.html https://www.ssllabs.com/ssltest/viewMyClient.html I imagine the issue is that we only support TLS 1.0+ and not SSLv2 or SSLv3. https://www.ssllabs.com/ssltest/analyze.html?d=news.ycombinator.com https://www.ssllabs.com/ssltest/analyze.html?d=news.ycombina...

yuhong 12y ago
I just tried it using IE6 with TLS 1.0 disabled and it does not load at all. If you watch the video carefully you will see the certificate errors that comes from the device having such an old certificate store too (in the case of google.com they now use GeoTrust with a cross certificate to Equifax). And I doubt the device support SHA256 certificates either. The device might not support the 3DES cipher suite either (as it was relatively slow compared to RC4) and many sites have disabled RC4.

Animats 12y ago

Security Theater Everywhere strikes again. Unless you're logged in and entering data, Hacker News does not need SSL.

geofft 12y ago
So I should take it that you're OK with every country's intelligence agency modifying links on HN for their citizens, redirecting crypto downloads to trojaned pages for specific users, suppressing links that are overly critical of the government, right?
- Animats 12y ago
  Protection against changes should be done with subresource integrity hashes (http://www.w3.org/TR/SRI/ http://www.w3.org/TR/SRI/). With HTTPS, an observer still knows who you're talking to, and since they can see how big the request and reply are, they can probably guess what you're looking at.
  - deleted 12y ago
    [deleted]
  - rgbrenner 12y ago
    SRI does not replace HTTPS. You say they can guess what you're looking at with HTTPS.. well if you use SRI without HTTPS, then they don't need to guess.. they absolutely know what you're looking at. Also, if they can change the page (which they can if it's over http), they can change the hash as well. Also, SRI is like 9 months old since the first draft... which means it does nothing for the visitor unless they are using the newest version of one of the major browsers.
  - geofft 12y ago
    I totally agree (although you need more than SRI, since you also need some way of signing the original content, but I'd love to see a full spec for this sort of thing). However, SSL is what we have right now that works. And I think, of the browsers that do support SRI (possibly in prerelease versions or behind feature flags), they require the page to be delivered over SSL anyway.
    - Animats 12y ago
      HTTPS is broken by content delivery networks who terminate SSL connections. HTTPS Everywhere makes the problem worse, by increasing load for static pages and breaking caches, forcing sites to use a content delivery network. Take a look at that HTTPS certificate that you think means you're talking to the site of your choice. If it says "cloudflare.com", "incapsula.com", "edgecastcdn.com", "palmwebservices.com", "cdnetworks.net", there is a man in the middle of your HTTPS connection. This is the case for at least 38,000 sites we know about. There are probably more. (The list: http://john-nagle.github.io/certscan/whoamitalkingto04.pdf http://john-nagle.github.io/certscan/whoamitalkingto04.pdf) HTTPS Everywhere was well-intentioned, but the people behind it didn't realize that high-volume use of HTTPS forced less secure use of HTTPS. That's why it's a form of security theater.
- voidz 12y ago
  Are you sure that the agencies you speak of are not able to do this anyway? Even the Hong Kong Post Office has a place among the trusted CA's supplied by most vendors: not really necessary for everyone on the planet, I'd think. If even just one of those trusted CAs would or has become compromised, all bets are off. Which has already happened in the past anyway. So, how you defend "SSL everywhere".. I don't buy it. I feel more for what the commenter you responded to said, because your counter argument comes with a lot of assumptions that have more problematic implications. A false sense of being secure does seem much worse than knowing that most of the stuff you do is actually insecure to begin with. Plain text is not a bug. It's a feature! Cheesy, I know.
  - yourad_io 12y ago
    > A false sense of being secure does seem much worse than knowing that most of the stuff you do is actually insecure to begin with. It may feel so, but it certainly isn't. Some security (against anyone but the top 0.X% of "bad guys") is certainly better than no security (random script kiddie in your coffee shop injecting 0-days from exploit-db straight to your browser). And regarding the hopelessness of SSL/TLS - the CA problem exists and is pretty huge. But we know the solution[1]: it's called certificate pinning. When you control clients (Google/Chrom[e/ium]) can just pin your own certs/CA and refuse anything signed by the Hong Kong office. For the rest of us that don't, there's HSTS (to tell the browser to refuse http:// http:// redirects from a MiTM, overriding TLS altogether) and Public Key Pinning Extension (HPKP). They aren't very widely rolled out, but we're getting there. Test your browser here[2], you may be surprised. This all assumes that the user won't ignore the warnings when they come up, of course. Also it would protect you from your second visit onwards - if you're being MiTM'ed at your first attempt to grab a site with all the above bells and whistles, your browser doesn't know about the pinned stuff yet, so it is vulnerable to SSL stripping, etc. In short, it's certainly better than nothing (protecting you from 99%+ of bad guys) and we're slowly fixing it[3]. Don't let the man get you down. [1] Until we get to a proper, more distributed solution [2] https://projects.dm.id.lv/Public-Key-Pins_test https://projects.dm.id.lv/Public-Key-Pins_test [3] Shamefully slowly - TACK was proposed so long ago... https://news.ycombinator.com/item?id=4010711 https://news.ycombinator.com/item?id=4010711
alfiedotwtf 12y ago
> Unless you're logged in and entering data, Hacker News does not need SSL What about if you're in a country that likes to censor the news?
- chrissnell 12y ago
  Why not create a non-SSL virtualhost? http://plain.news.ycombinator.com http://plain.news.ycombinator.com or similar.
  - oneeyedpigeon 12y ago
    Or just have each protocol do what it's supposed to, rather than redirecting one to another? In general, aren't advanced users supposed to like having the option to make their own decisions?
    - innocenat 12y ago
      Yeah. How many users (not power users) actually type https:// https:// into address bar? To my knowledge, if you don't include the protocol, browser default to HTTP.
      - pizzeys 12y ago
        Not on Hacker News (and many other sites) with a modern browser. The first time you visit http://news.ycombinator.com http://news.ycombinator.com, it will redirect to https:// https://, and you're correct, if the first time you visit happens to be the time you are MITM'd, this is a weak point. However, after the first visit, your browser learns through HSTS (the Strict-Transport-Security header) that accessing news.ycombinator.com without TLS is not supported, and won't attempt to access it again except via TLS. (For a year, in HN's case - this is configurable by the site administrator.)
        vertex-four 12y ago
        Point is that your grandparent comment was suggesting that visiting http://news.ycombinator.com http://news.ycombinator.com should not redirect to HTTPS.
ihodes 12y ago
Instead of continuing the trend of downvoting you: Without SSL, you can't be sure of the integrity of the data set by the site. It's important even when not exchanging private data.
acdha 12y ago
If you were looking for MITM targets likely to have access to many interesting things, HN would be high on the lists of sites to intercept.
deleted 12y ago
[deleted]
agwa 12y ago
In addition to thwarting state-sponsored attacks mentioned by geofft, HTTPS also prevents ISPs and hotels from injecting ads[1,2]. And using HTTPS even for logged-out users prevents an attacker from sslstripping[3] the link to the login page, which is good because even the most careful users won't always notice when a login page is suddenly served over an insecure connection. As a user of HN, I appreciate these security features. Suggesting that HN should not use HTTPS so that someone can access it from a 10 year old device that's impractical for modern web browsing anyways is possibly the weakest argument you can make against HTTPS. [1] http://arstechnica.com/tech-policy/2013/04/how-a-banner-ad-for-hs-ok/ http://arstechnica.com/tech-policy/2013/04/how-a-banner-ad-f... [2] http://justinsomnia.org/2012/04/hotel-wifi-javascript-injection/ http://justinsomnia.org/2012/04/hotel-wifi-javascript-inject... [3] http://www.thoughtcrime.org/software/sslstrip/ http://www.thoughtcrime.org/software/sslstrip/
- deleted 12y ago
  [deleted]
- roywiggins 12y ago
  T-Mobile opted me in to a content filter by default. To remove it, last I saw I needed to give them my SSN (!!!). So, I live with the idiot filter, which actually scans for keywords in websites and blocks them. SSL obviously makes this sort of filtering useless, which is very useful.
  - CamperBob2 12y ago
    Wow. This is in the US, I assume ("SSN")? I've never heard of this happening with a US carrier.
    - ChristianBundy 12y ago
      Yeah, social security number. It's basically a private key we're all assigned at birth that can't be rotated. It was originally meant to be used in the state-sponsored welfare program "social security", but tons of businesses require it as a unique identifier. Absolute stupidity on all fronts.
nailer 12y ago
Firesheep would allow some guy at your coffee shop or conference to steal your user account. SSL would stop them.
peterwwillis 12y ago
The "security theater" comment probably got you downvoted because it seems like an insult against HN, when it's probably more of a general reflection that not all sites need HTTPS, which is a fact (some need to not have encryption, both legally and for functional reasons).
mobiplayer 12y ago
If you only encrypt what's important, you're doing your "enemies" half of their work :)

marcosscriven 12y ago

Same happened to me trying to use Safari Books Online on my Kindle browser (as the only official way yo access their content on an eInk display). They dropped SSLv3, and in doing so the old 'experimental' Kindle browser can no longer access it.