The Internet Archive Switches To HTTPS Connections By Default

← Back to Stories (view on slashdot.org)

The Internet Archive Switches To HTTPS Connections By Default

Posted by timothy on Friday October 25, 2013 @11:40AM from the rewriting-history dept.

An anonymous reader writes "The Internet Archive today announced it has enabled HTTPS connections by default on archive.org and openlibrary.org. The organization today also revealed it now sees over 3 million users per day. Both sites are still accessible over HTTP connections. Since the Wayback Machine is hosted on archive.org, it also follows the same rules: the secure version is used by default, but you can use the http version which will help load certain complicated webpages."

40 comments

Min score:

Reason:

Sort:

Internet Archive leaves /. behind by tepples · 2013-10-25 12:03 · Score: 4, Interesting

If Facebook and Twitter and Gmail as well as the not-for-profit Internet Archive and Wikipedia can use HTTPS by default, why doesn't everyone? Why, for instance, does Slashdot require a paid subscription in order not to redirect HTTPS hits to HTTP, revealing the logged-in user's session ID to anyone with a Firesheep-like tool?
1. Re:Internet Archive leaves /. behind by Mister+Liberty · 2013-10-25 12:50 · Score: 1
  
  When your government regards YOU as their biggest enemy,
  and YOU should thus consider them in reverse, https is a false
  sense of security.
  Oh and btw, INTEL inside.
2. Re:Internet Archive leaves /. behind by cffrost · 2013-10-25 14:46 · Score: 3, Insightful
  
  When your government regards YOU as their biggest enemy,
  
  Yes...
  
  and YOU should thus consider them in reverse,
  
  Uh huh...
  
  https is a false sense of security.
  
  No, it's partially broken, vulnerable-to-attack security, whereas HTTP is completely vulnerable, bare-naked plaintext — nothing to break, no certs to MITM, no bribing CAs for keys — zero security.
  As bad as HTTPS may be, comparing it to HTTP in terms of security is idiotic.
  
  --
  Thank you, Edward Snowden.
  
  "Arguments from authority are worthless." —Carl Sagan
3. Re:Internet Archive leaves /. behind by Anonymous Coward · 2013-10-25 16:27 · Score: 0
  
  And now you know why there are so many of us who are AC.
4. Re:Internet Archive leaves /. behind by Impy+the+Impiuos+Imp · 2013-10-26 03:33 · Score: 1
  
  It also does little to protect against NSA letters at the destination sites. Everybody except the government can't see what you're doing.
  For the wayback machine, this could actually be an NSA goldmine to find terrorists...or people digging up dirt on other politicians...or businesses looking things up.
  
  --
  (-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Who Cares? by sexconker · 2013-10-25 12:11 · Score: 0, Troll

Why is this news?
All the sites I work on rewrite any http url request to https because there's absolutely no reason not to.
Advertisements by pavon · 2013-10-25 12:19 · Score: 5, Informative

The main thing holding back HTTPS is advertisements. Browsers (especially IE) complain if your encrypted page includes unencrypted content (like iframes served from a a third party ad server) and rightly so. Google can get away with it because they serve their own ads, and Wikipedia doesn't have any ads. Arstechnica ran an article a few years back describing the reasons why they couldn't switch to HTTPS by default, but most of it boils down the fact that they can't get rid of the third party content in their pages.
1. Re:Advertisements by claar · 2013-10-25 12:59 · Score: 3, Insightful
  
  So get the ad companies to serve the ads over HTTPS... I don't see the big deal.
  
  --
  I'd give my right arm to be ambidextrous...
2. Re:Advertisements by davester666 · 2013-10-25 15:55 · Score: 2
  
  It raises costs, while providing them with no value [at least until sites like ars switches to https and tells them to fuck off unless they do as well]. And with online ads decreasing in value [and decreasing even faster for mobile ads], they really don't want to increase costs.
  And it's not just a one-time certificate purchase, it's a bunch more powerful servers to do this encryption and electricity to run the servers and more people to keep their cobbled together solution working with these new servers.
  
  --
  Sleep your way to a whiter smile...date a dentist!
3. Re:Advertisements by AHuxley · 2013-10-25 16:20 · Score: 1
  
  Yes even with all the new easy low cost (price and power usage) cpu's for https, cheap bandwidth and less time per encrypted page its still not totally 'free in cost' for a host.
  
  --
  Domestic spying is now "Benign Information Gathering"
NSA concerns by Anonymous Coward · 2013-10-25 12:31 · Score: 0

Wouldn't it be beneficial to various sites to switch to HTTPS-only as we know today that NSA might be doing MiTM wiretapping even though we supposedly are communicating over "trusted" big-telco networks?
AdSense supports HTTPS by tepples · 2013-10-25 12:32 · Score: 2

Browsers (especially IE) complain if your encrypted page includes unencrypted content (like iframes served from a a third party ad server) and rightly so. Google can get away with it because they serve their own ads
Then use the ads that Google serves. A month ago, Google announced HTTPS support for AdSense.
1. Re:AdSense supports HTTPS by tlhIngan · 2013-10-25 17:18 · Score: 3, Insightful
  
  Then use the ads that Google serves. A month ago, Google announced HTTPS support for AdSense.
  And yet, Google doesn't roll out HTTPS support for the rest of the ad companies they own? You'd think if they can do AdSense, they can do AdMob and DoubleClick and their many other ad platforms they host...
  Given Google serves like 98% of the ads on the internet (through AdSense, DoubleClick and other companies), it seems Google's the one holding HTTPS everywhere...
Just a speed bump for the NSA by Spamalope · 2013-10-25 12:37 · Score: 1

This is nice to, say, stop Comcast from spying on the details of what you view for resale to behavioral trackers and marketers. Given the compromise of the SSL cert authorities, governmental entities can transparently man-in-the-middle the SSL session anyway so we only get part of what we'd like to achieve.
hotstpots by manu0601 · 2013-10-25 12:38 · Score: 2

HTTPS by default is nice, except for WiFi hotspots, where the authentication system intercept your first HTTP request. This cannot be done with HTTPS, which means that people with an always HTTPS home page will never auto-connect. I wonder if there will ever be a solution to that.
1. Re:hotstpots by Anonymous Coward · 2013-10-25 13:03 · Score: 1
  
  I just go to Slashdot first, which will never use HTTPS!
2. Re:hotstpots by Anonymous Coward · 2013-10-25 13:13 · Score: 0
  
  Indeed, Come on Slashdot, this is 2013 not 1993!
3. Re:hotstpots by Elbereth · 2013-10-25 14:59 · Score: 3, Funny
  
  It's always 1993 here. In fact, when I come to Slashdot, Heart-Shaped Box is always playing on the radio, everyone is playing that new game Doom, and I have a life. Ah, it's grand to come to Slashdot!
4. Re:hotstpots by binarylarry · 2013-10-25 17:03 · Score: 1
  
  Replacing HTTP with SPDY (or similar modern protocol) would be a good start.
  
  --
  Mod me down, my New Earth Global Warmingist friends!
5. Re:hotstpots by Anonymous Coward · 2013-10-25 20:06 · Score: 0
  
  Getting rid of the authentication system would be a great way to do it. It doesn't accomplish anything useful - it just wastes a minute of my time, and messes up HTTPS.
6. Re:hotstpots by Anonymous Coward · 2013-10-27 04:56 · Score: 0
  
  If only, I wish I was stuck in (the very beginning of) 1993 rather than StuckIn2003&Expired
  BTW and in case you don't get told often enough: your nick is the best!
always https & sftp by Anonymous Coward · 2013-10-25 12:49 · Score: 0

This makes loads of sense. On a related note, my web host recently disabled https connections to the control panel & webmail. They also just last month removed support for SFTP (without notice). When I contacted support to ask why this had been done, their response was "for security reasons". It's pretty clear whose "security" they have in mind.
Can anyone recommend a secure, non-US web host?
1. Re:always https & sftp by Anonymous Coward · 2013-10-25 14:33 · Score: 0
  
  Just use a real internet hosting provider like OVH or Leaseweb.
SSL irrelevent. by koan · 2013-10-25 13:23 · Score: 1

SSL strip (Moxie Marlinspike) or some suped up variant is being used for sure, the NSA has the ultimate MITM so of course they strip.

--
"If any question why we died, Tell them because our fathers lied."
1. Re:SSL irrelevent. by Anonymous Coward · 2013-10-25 14:24 · Score: 0
  
  You are dangerously clueless.
  ie: client site
2. Re:SSL irrelevent. by Anonymous Coward · 2013-10-25 15:10 · Score: 1
  
  Maybe you're lucky, but some people have more than one enemy in the world, not just the NSA.
3. Re:SSL irrelevent. by Anonymous Coward · 2013-10-25 15:34 · Score: 1
  
  SSL strip (Moxie Marlinspike) or some suped up variant is being used for sure, the NSA has the ultimate MITM so of course they strip.
  Only if they have the CA. Can't strip if you can't generate new certs, and even then that is detectable.
HTTPS by slick7 · 2013-10-25 13:33 · Score: 1

HTTP that (S)queals to the NSA.

--
The mind conceives, the body achieves, the spirit manifests.
SSLv3... by gQuigs · 2013-10-25 14:00 · Score: 3

I browse with SSLv3 disabled... and https://archive.org/ only supports SSLv3... why? Most webservers have supported TLS 1.1/1.2 for ages now.. right?
1. Re:SSLv3... by Anonymous Coward · 2013-10-25 14:42 · Score: 4, Informative
  
  I refreshed the page like 5 times and got a different block cipher and key exchange protocol each time, from crappy rsa-rc4 to a mighty ecdhe-aes128-gcm. Also some dhe-Camellia256 and and rsa-aes-cbc in the meantime.
  There seem to be a whole farm of servers with heterogeneous configurations back there, someone should look into it.
  While i could understand this is some "bright" new idea to mitigate the impact of one protocol being broken (not putting all eggs in the same basket), i say with confidence that AES-CBC prior to TLS1.1 and all variants of RC4 are irremediably broken. Broken like in "you can recover the plain-text in a handful of minutes using python on a 300$ netbook with only half a brain".
2. Re:SSLv3... by Anonymous Coward · 2013-10-26 02:33 · Score: 1
  
  all variants of RC4 are irremediably broken
  [citation needed]
  Just because RC4 _as used in WEP_ (or some other badly-designed protocol based on RC4) is insecure doesn't mean "all variants of RC4" are "irremediably broken" (whatever you mean by that).
  In fact, if you bother to look up the latest academic attacks on RC4 (published in 2013), you'll notice that they are outside the range of "a 300$ netbook", even with a "handful of minutes", since it requires the attacker to obtain 2^24 (that's more than 16 million) connections. I don't know about you, but I don't use HTTPS _that_ much for this to be a trivial attack.
  Sure, maybe (i.e. hypothetically) the NSA or some other state-level attacker can decrypt RC4, perhaps, BUT you have yet to produce any evidence of that (and I doubt you can, really), which makes you comment not that "informative", in fact.
  Have a nice day and don't forget to wrap another layer of tinfoil around your head.
Here's hoping Yahoo Mail will catch up. by Anonymous Coward · 2013-10-25 16:00 · Score: 0

n/t
The Internet by Anonymous Coward · 2013-10-25 18:49 · Score: 0

I accidentally read the title of this article as "The Internet switches to HTTPS connections by default". That would have been nice.
1. Re:The Internet by Geeky · 2013-10-26 02:58 · Score: 1
  
  Devil's advocate:
  Why?
  Most of the sites I visit don't require logins and so I can't see a reason to use https. Why would I need it in Wikipedia unless I'm editing it? Why would I need it on the internet archive unless I log in? Why would, say, the BBC News website need it at all?
  Yes, for anything where you actually log on and do anything under a user account, https is important. I can't see any real reason for static content served to users who aren't logged on to be encrypted if it's just a news website, personal blog or whatever.
  Encryption brings its own headaches to shared servers - name based virtual hosts being the obvious one. It's an overhead that isn't really required in most cases.
  
  --
  Sigs are so 1990s. No way would I be seen dead with one.
2. Re:The Internet by Anonymous Coward · 2013-10-26 05:32 · Score: 0
  
  What I would be concerned about is whether older browsers being able to access the site still. It's not just requiring SSL or whatever. It's also about websites blocking older browsers.
  Not every machine is powerful enough (or has the specs) to run the latest Firefox.
  It's fine if they want to default to HTTPS. It's not fine to block people who won't/can't use HTTPS.
3. Re:The Internet by Hentes · 2013-10-27 10:36 · Score: 1
  
  Why would I need it in Wikipedia unless I'm editing it?
  Because you may not want others to know what exactly have you been looking for on Wikipedia.
4. Re:The Internet by Anonymous Coward · 2013-10-28 19:15 · Score: 0
  
  Name based virtual hosts over SSL work just fine and have for many years. Look up SNI on Wikipedia.
Trust has a value by tepples · 2013-10-26 00:54 · Score: 1

while providing them with no value
The value is more visits from viewers who trust a site more because their sessions won't get hijacked.

And it's not just a one-time certificate purchase, it's a bunch more powerful servers to do this encryption
You mean 1% more powerful? On a site that isn't just a bunch of static pages, the server power needed by the web application usually outweighs the server power needed by HTTPS on the front end servers. The question becomes whether trust from users is worth this 1%.
1. Re:Trust has a value by davester666 · 2013-10-26 11:05 · Score: 1
  
  Well, for ads, the percentages change. It is unlikely to be 1%, as the article refers to generating full, non-static web pages, which in general are NOT what ad services are pushing.
  They are just a small portion of the whole page, and they are generally static, so again, the cost for pushing the ad becomes significantly more than the cost for pushing the ad without SSL.
  And with ad rates going down, even for Google, adding to the cost of pushing each ad won't thrill the boss.
  
  --
  Sleep your way to a whiter smile...date a dentist!
Caching Proxies by Anonymous Coward · 2013-10-26 10:29 · Score: 0

HTTPS for everything is/would be a total pain for companies that currently use caching proxies. Of course its needed for personal or financial data etc but for truly public things (news websites, public text content e.g Slashdot ) proxy usage can save loads of bandwidth for companies. We save 10 - 20% of bandwidth using this. Not to mention faster load times for popular sites. HTTPS is just a waste for public content.