Slashdot Mirror
Google Proposes To Warn People About Non-SSL Web Sites
mrspoonsi writes The proposal was made by the Google developers working on the search firm's Chrome browser. The proposal to mark HTTP connections as non-secure was made in a message posted to the Chrome development website by Google engineers working on the firm's browser. If implemented, the developers wrote, the change would mean that a warning would pop-up when people visited a site that used only HTTP to notify them that such a connection "provides no data security". Currently only about 33% of websites use HTTPS, according to statistics gathered by the Trustworthy Internet Movement which monitors the way sites use more secure browsing technologies. In addition, since September Google has prioritised HTTPS sites in its search rankings.
completely
Did slashdot just die and silently come back up? I was getting 503's and "offline mode", logged in and out for ages, then suddenly its just working again. Anybody else experience anything like that?
This tagline was transcoded to result in at least one smirk. If you experience failure to smirk, please consult your Gen
and actually use ssl instead of redirecting you back to http or having messed up certs..
ITS NOT THAT HARD OR EXPENSIVE FOR FUCK SAKES
So uhhh... Slashdot is a Non-SSL website.
Encryption has a cost, it isn't free. It increases CPU utilisation and power consumption. It interferes with caching and reduces network efficiency.
This is a dumb idea. A very dumb idea.
-1 Uncomfortable Truth
The major downside to this is promoting the idea that an https connection is "secure", because especially when it comes to https, there are so many different attacks to level against both an end user and a host that we'd be better using a risk grading system.
seriously, fuck google
<----------------- You must be at least this intelligent to ride the internet.
Currently only about 33% of websites use HTTPS, according to statistics gathered by the Trustworthy Internet Movement which monitors the way sites use more secure browsing technologies. In addition, since September Google has prioritised HTTPS sites in its search rankings.
Um... Secure != Trustworthy and, seriously, most web connections DO NOT NEED to be HTTPS.
Furthermore, I cannot filter HTTPS via my proxy filter (Proxomitron) to strip out annoying things, like the fucking Google sidebar and other forced "user experience" settings - which is why I use nosslsearch.google.com ...
It must have been something you assimilated. . . .
Problem with the web: too many websites with too much content, not one answer that can be given consistently to similar questions:
Solution: standardize the web, with Wikipedia, Google Knol, etc. and squeeze out those smaller websites so they stop mucking up the corporate profits.
When the sheep get warm and comfy enough, yank anyone who doesn't dish out for SSL, and make it so that it costs a thousand dollars a year to reasonably publish on the web, instead of the pennies it did a few years ago.
Then, you have total dominion and total control. For much profit!
Futurist Traditionalism
I applaud this move, but ONLY IF https websites are also flagged as being insecure (typical example follows).
https://www.whynopadlock.com/
If google starts their own CA and gives away DV SSL certs (all sorts, counting wildcard, multi-domain), then I'm on board more or less. SSL should be free.
*Warning, insecure content!* This website doesn't have a NSA backdoor, and hence we cannot verify the americanness of the content. Terrorists may be hatching a plot to blow up something here. Or even worse, normal people might be talking how we fucked the web up. >OMFG! Take me out of hereI understand the risks
I run a personal site off a laptop on my home connection. I had HTTPS enabled, but when Firefox added a warning against all self signed certs, users were constantly complaining that my website was down or broken. So I turned it off. Now Chrome users are going to be complaining that my site is broken.
I guess the solution is to remap all Chrome users to HTTPS and Firefox to HTTP. IE users can go where they please. I don't get Safari users. I hate to say it but IE is slowly, very very slowly, becoming the best browser.
Sweet! Now I'll need to get SSL keys for all of my web basic administration consoles on my already secured private LAN, or else management will yell at me. This sounds GREAT!
I see the value of the proposal: it is easy to inject malware inside a HTTP stream. Snowden documents taught us that the NSA and CGHQ do it over internet backbones. Infected machines also do it when it is easy (hint: WiFi). Pushing towards HTTP/SSL address that
However, with only 33% of the sites that are SSL enabled, they are just going to show warnings everywhere, and users will quickly learn to ignore them.
I find it more than ironic that this article was posted on Slashdot, which in 2014..still doesn't support SSL. It'll even redirect HTTPS to plaintext HTTP!
While I think you should use HTTPS, it's also quite easy to strip away, anyone in the "man in the middle" position can do this, so no problem for the NSA, no problem for an ISP, no problem for a decent hacker (WiFi anyways), however it is "better than nothing".
Which seems to be what we have to settle for these days BTN "better than nothing".
"If any question why we died, Tell them because our fathers lied."
Firefox added a warning against all self signed certs
It makes sense: encryption without authentication is useless, as the browser gets a secure channel to talk with an unidentified peer. It can be your server, it can also be a man in the middle, there is no way to tell.
You can get a properly signed SSL certificate for free from STARTSSL, therefore there is no excuse for your broken setup.
If 90%+ sites used SSL this would be a great idea.
If only 33% sites use SSL, then this warning will be popping up on the majority of websites that people visit.
Guess what happens when an ordinary user sees a warning pop up repeatedly? That's right, they start ignoring the warnings.
How many of you have tried " https://www.slashdot.org/ " ?
How many of you succeed ?
Have they ever read "The boy who cried wolf"? You warn people that their local community bulletin board website isn't encrypted enough times and they will probably start to ignore all your warnings. All this would probably do is annoy people to the extent that they will automatically click away any warning window, including when certs are invalid, possibly forged etc. In other words, it will really annoy people and could even be detrimental to security. Maybe if they restricted it to POSTs not GETs, though that may just incentivize lazy developers to use GETs instead of POSTs.....
Monstar L
>"If implemented, the developers wrote, the change would mean that a warning would pop-up when people visited a site that used only HTTP to notify them that such a connection "provides no data security"."
Arrogant, annoying, unnecessary, stupid, and inaccurate. There are a LOT of sites that have absolutely no need for https and labeling them "insecure" will annoy clue-full users and confuse clueless users all in one swoop. And by encrypting everything, it makes caching far less useful and slows down browsing some.
This type of attitude in design is one of many reasons I don't and will not use Chrome. It is bad enough some of the recent stuff being shoved into Firefox :(
Sucks if you're running a static host on S3 since it's close to impossible to get an ssl cert hooked up to that.
I'm operating a small web site, mostly to promote my business. It's there, it works, I don't do much about it.
I've considered https, but it's too hard for me as a small web site owner: first I have to manage to get an SSL certificate (costs serious effort and money), then I have to figure out how to install it correctly (tried it before with a self-issued certificate and failed; while I'm fairly computer savvy), finally I have to somehow remember to renew it every few years or so - which is an interval way long enough to completely forget how the installation worked, so I have to start all over again.
Now it seems Google gives higher ranking to https sites - meaning my site gets a lower ranking, that's bad. Next Google is starting to warn people to stay away from my site as it's not secure: why should I want to encrypt what is otherwise public information, like event schedules and itineraries? I put that information on my web site with the express purpose of reaching as many people as possible.
There are many people like me, who put up a web site just for promoting their business. It doesn't make sense to encrypt this info, at all. It doesn't make sense to downgrade ranking for that reason. Very bad move by Google.
So much for the 'information superhighway'.
I have to have an adblocker running just to keep my browser from turning into a scene of Times Square on a bad acid trip, even on reputable sites which brings the page load to a crawl. Most browsers have some warning for this or that, little green or red padlocks, etc.. Everything might be unsafe, click at your own risk!
If I were a pilot and there were the same number of warnings and blinking lights flashing in the cockpit I probably would have bailed out long ago.
On one extreme you could lock your browser down so hard that there would be little point to attempting to connect to the internet, you'd never get anywhere. On the other you could strip away all of the protections and get pwned in a heartbeat (or maybe not).
I'm not an IT professional by any means, but the current state of the internet is a discordant mess of virtual business fronts and libraries all facing a street prowled by every type of criminal and depraved individual imaginable (and a few that you can't imagine). Have a nice walk down Main St., if you dare!
If we could at least have a secure Main Street, and leave everyone free to go to the seedier side of town if they wish, wouldn't that be great? I'm not sure whether this is technologically achievable. I have to say things are not working well and I sometimes think that the Internet has jumped the shark and it can't last in this state. It's becoming less safe and usable by the day.
Left MS Windows for Linux Mint and never looked back!
Vote for Bernie in 2016!
Oh brother. Big brother, that is. As if everything you do with Google (and pretty much anything else) wasn't being carbon copied directly over to some NSA server *after* decryption on the other side. What a joke.
It's not nuts. It's sly. What they're trying to do here is force increased purchasing of SSL certificates from third parties. It's about profit and the wealthy and powerful scratching each other's backs. Sure, you can put in your own, but the the browsers will all put up scare dialogs about how they don't know who issued the cert, and away go your visitors / customers.
Do you NEED to have SSL for your blog? For your comic strip? For your aquarium how-to pages? For your archive of 50's pinups? For your CGI that calculates pixels-per-planet for specific lens magnifications and sensor densities? Doubtful. Well, they're looking to change that. It'll be SSL or no visitors, and the web gets hooked even further into the pockets of commercial interests, while the cost of entry slowly inches away from the poor.
Coincidence? Hardly.
Google's pissing directly on your heads here and trying to tell you it's rain.
No, it's more like two beers. And I rather have the fucking beer. You idiots who go "it's only $X" don't seem to EVER understand that eventually, all those "it's only $X charges run un right the FUCK out of available cash. You DO know my power company wants those dollars, right? And the gas company? And the filling station? And the grocery store? You're so fucking glib about the $9, why don't you set up a web site to send $9 to everyone once a year? IT'S ONLY $9, RIGHT? You won't notice. You clearly have nothing better to do with your money.
It makes sense: encryption without authentication is useless, as the browser gets a secure channel to talk with an unidentified peer. It can be your server, it can also be a man in the middle, there is no way to tell.
You mean other than manually comparing the certificate against a known-good copy you previously obtained through a trusted channel then telling your web browser to memorize it as a known-good certificate?
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
You know you can get free SSL certificates, right?
Encouraging the web to go 100% SSL only is a unquestionably a good thing.
The issues with performance were gone a decade ago...and certs can be obtained cheaply or an no cost. It makes no sense that all the "anti-SSL"
posts have been modded up.
How much did the CA cartel pay Google to come up with this load of BS? Talk to me about SSL everywhere when everyone is using DANE and CAs have long since gone out of business.
You don't scare people with warnings like this. Crying wolf only places your users at increased and unnecessary risk.
Just use a free TLS cert from StartSSL
Encouraging the web to go 100% SSL only is a unquestionably a good thing.
Not if it means paying rent to CAs every year so they can sit on their fat ass and do nothing.
The issues with performance were gone a decade ago...
Even if maintaining session state and TLS were completely free round trip delay and assuming the best case that session resumption occurs for all accesses you still have to eat additional round trips...delay that is quite noticeable to those accessing content internationally and over wireless or low bandwidth links.
It makes no sense that all the "anti-SSL"
posts have been modded up.
Why should people have to screw with SSL when they have no secure content to offer? This is what makes no sense to me. Google is twisting arms to have their way.
Regardless of what you think of making everything "secure" I don't subscribe to the notion that ends should justify means.
About time you guys implement it on your home page I think...
Some of us have been wanting https everywhere for more than 10 years. its about fucking time.
And I'm also guessing that the fucking whiners about CPU costs and cert costs are also Libratards who are always looking for a free lunch or looking to get someone else to pay. First to whine about taxes also first in line for a handout.
The world is pay to play.
Google may be shooting themselves in the foot when it comes to things like Google Analytics. Finding out what pages people come from is very useful
only problem is it assumes SSL/TLS is actually secure...
Please at least wait until distributing certificates through DNS takes off (DANE).
CA-based TLS is not going to work for everyone. Of course, people in the corporate world couldn't care less - but many of the best parts of the web don't come from the corporate world.
I'm not sure what is the advantage of forcing https on sites that do not need it. Sounds like another chapter of security paranoia soap opera.
The choice about whether or not to encrypt traffic should be left to each website's administrator. Many sites--shock!--use the web to disseminate information they wish to be public, and the site's users have no problem with their access to it being public either. So get out of their faces! Using the browser to deprecate admin's particular choices is contrary to the spirit of the web, which should always do its damndest to serve something, and degrade gracefully when it's in difficulty, not pop annoying dialog boxes in the user's way.
Self-certificates are already a fairly effective denial of service attack when Firefox is used to access many independent sites that try to implement https, but who fail to do so in a way that offers a smooth user experience to J. Random User (I'm thinking particularly of IndyMedia).
Please note: in China, the censorship does not rely on blocking everything; just on blocking enough that all but the very motivated fail to access it. This troublesome minority can presumably be picked off at leisure later.
Keep it simple, stupid!
You can never eat too much, only cycle too little.
Generally when I try to set up HTTP/SSL in Apache, I get warnings that I can't do virtual hosts for SSL. In fact, I was able to force this through in the past. But I think there's supposed to be some issue with it. I think it's something along the lines that if a connection is encrypted, the server doesn't know what the URL is until it's decrypted, and it can't really decrypt until it knows what the virtual host is. Something like that....
So does it mean that adoptions of HTTP/SSL everywhere will be the end of virtual hosting, and then force each web domain to have a different IP address?
What a great idea. It seems the next poodle will be able to bite off a chunk of the entire Web, not just its HTTPS part.
No - this problem is solved with SNI (Server Name Indication) which is part of all the current browsers, and has been for a while now. The client tells the server which certificate to return (which hostname it's going to ask for) in plaintext. There's probably a module you need for Apache to support this - IIS finally does it natively, so I'm sure it was already there in Apache/nginx.
There is no need for SSL everywhere and punishing sites without it by ranking them lower is just plain wrong. Why on earth would a brochure style site for a business need SSL? Why does Wikipedia need SSL (for readers, not for editing)? Why do blogs need SSL for readers? Why does the BBC News website need SSL?
There are a vast number of sites that have no need for SSL and it's simply unnecessary overhead.
Sigs are so 1990s. No way would I be seen dead with one.
You were observed attempting to leave comments about Feelless Leader. We is blocking all Sony Swine Dogs!
Or at least, makes more sense than throwing up a giant red "WARNING: THIS SITE IS INSECURE!" page for HTTPS self-signed, but *not* for every other HTTP-only site.
-- 'The' Lord and Master Bitman On High, Master Of All
Most non-SSL sites use a single IP address for multiple sites and the actual hostname portion of the URL is not known until the GET request.
Assuming that we want IPv4 to continue to work, a mechanism to permit an SSL certificate to secure a group of sites would be needed before more widespread use of SSL for non-commerce/non-login sites would be practical.
Essentially, if a server hosts 30 domains, the server's certificate would need to have a certificate of its own and that certificate would have to be signed by EACH of the 30 domains. That is tricky and would require revision of HTTPS. You would probably have to have the server initially use its OWN unsigned/self-signed certificate to establish an SSL connection, have the browser specify the hostname, then have the server return a signature record that uses that hostname's certificate to sign the fingerprint of the server's SSL certificate. Once the browser confirms that the appropriate CA signed for the hostname and the hostname signed for the server, then it could continue the request (and cache the server's fingerprint).
Google should get cracking on this new HTTPS handshake first.
Encryption has a cost, it isn't free. It increases CPU utilisation and power consumption. It interferes with caching and reduces network efficiency.
This is a dumb idea. A very dumb idea.
https://www.httpvshttps.com/
You do need HTTPS to protect mundane content: Saying otherwise is very short sighted...
You might not care about the content, but the way someone, somewhere, is accessing it, does offer a lot of "value".
It can allow a watchful eye to either accuse the reader of being outside the norm, criminal, not respectful and whatnot (reason why librarians fought hard for the right to lend books without giving the list to the state!) or allow them to caracterise, profile, target a person over time for many different reasons.
Thus everyone should have the to right to read anonymously and willingly.
Witholding this right from others is being complicit with opressors.
I trust that self-signed cert more than any of your "trusted" CAs you fuckers!
The untrusted certificate warning page offers a button to view and add a certificate. If and only if you have verified the key fingerprint of a particular site's self-signed certificate out of band, it's secure to click that button. Just don't expect the general public to add your own site's self-signed certificate without giving them a secure way to verify that they're not behind a MITM.
Why must any site be unencrypted?
Because it may not be worth it for every operator of a small web site to pay extra per month to a hosting provider and certificate provider to enable encryption. In the case of StartSSL, this payment is not in money but in the labor to renew every year. And though modern browsers support Server Name Indication (SNI) to allow name-based virtual hosting over HTTPS, HTTPS shuts out those remaining users of Internet Explorer on Windows XP unless you pay your hosting provider extra for a dedicated IPv4 address.
It has bugged me for years that unencrypted plain text data is given a pass, but a self-signed certificate with encryption brings up a warning that requires multiple clicks and in some cases even importing a certificate to get through.
I think this double standard relates to the difference in end users' expectations when they see "http" or "https" in the address bar. People have been conditioned to think it's OK to put in a password or a credit card number just because the URI scheme is "https".
I fail to see how going to my local newsite to read about the new antics of our clown politicians needs to be encrypted [...] I will encrypt what I deem to be sensitive in nature.
Your session cookie, which represents your privilege to read the news site, is "sensitive in nature".
and load slower because the proxy can't cache it when a fellow work colleague visited the site earlier in the day.
Just because your "fellow work colleague" paid for a subscription to your local news site doesn't mean you did as well. Even if the site isn't paywalled, you could install the root certificate of your office's HTTPS proxy and surf through that.
it seems nice that google is concerned about everyone's page traffic being secure, but really I think this is about referrer click tracking.
It turns out that if you go from a SSL page to a non-ssl page, the new page doesn't get a referrer in the request.
this really messes up the stats for the pages that are getting this traffic. they can't tell why the user came to them from the referrer. it might be a google search for terms that they can't see ... so they can't customize the ads to the user that way, and they can't trend what keywords people are looking for.
the more pages are SSL, the more they can do this
Why do we need security to view academic articles
The site needs SSL's confidentiality to protect your session cookie, which represents your subscription to the journal that includes the academic article, from getting Firesheeped by an eavesdropper. And you need SSL's integrity and authenticity to ensure that the data tables in the article aren't modified in transit.
The passive observer can see which IP you're going to, and in everything but Internet Explorer on Windows XP, the passive observer can see which hostname on that IP (the SNI field in the ClientHello message).
Perhaps operators of a read-only web site with a premium section are afraid that someone will read the premium section by Firesheeping your subscribed user account.
Startssl.com offers free certs
Unlike web hosting, StartSSL does not auto-renew.
contact your hosting provider, and they should be able to do this for free or a very small charge; if they want an arm and a leg, it's time for you to find a better host.
For a small site, WebFaction will probably work unless much of your audience uses Internet Explorer on Windows XP.
This "non-trivial number of users" is already compromised or very close to it. Because Microsoft is no longer issuing security updates for Internet Explorer on Windows XP, you can probably assume that Internet Explorer on Windows XP is insecure in other ways that could compromise your users' confidentiality.
Bing and Yahoo's web crawlers do not support SNI
When was that? Apparently Bingbot supports SNI as of three months ago.
let you track what certificates other people are seeing for a site
The Perspectives plug-in for Firefox uses the same route diversity technique to expose a man in the middle that attacks some routes to the server but not others. But the Perspectives white paper discloses that this approach is vulnerable to what it calls the "Lserver attack": a man in the middle between the server and its only connection to the Internet.
its a free forum, why the fuck would they waste processor resources to encrypt the content? Their is nothing to secure
Other than the session cookies of its users. Am I the person who created the "tepples" account or someone who Firesheeped his session cookie?
UTF must stand for Unpossible Terrifying Fuckery
For a while, Slashdot did support Unicode. This allowed vandals to not only evade the ASCII art lameness filter with foreign characters but also use bidirectional override characters to impose Unpossible Terrifying Fuckery on the site's layout.
Your fertilizer page is 14674 bytes in length.
Plus 1-500 bytes of randomized padding added to the HTTP headers and the HTML comments that the server inserts to foil BREACH attacks.
DANE, Perspectives, and other CA-free approaches are equivalent in assurance level to a domain-validated certificate from a CA. The difference between a domain-validated certificate and an organization-validated certificate is that it's a lot harder for a typo squatter to get an organization-validated certificate for, say, "bankofamerrica.com". This is why the Comodo Dragon browser warns for domain-validated certificates.
Caching in the browser works as well with HTTPS as it does with HTTP. A caching proxy works too so long as each user of the caching proxy imports the caching proxy's certificate.
All you have to do to enable SSLashdot is log in and subscribe.
All communications should be encrypted at all times, otherwise it is a privacy leak waiting to happen.
You don't have those already? .. Slacker.
Encouraging the web to go 100% SSL only is a unquestionably a good thing.
Not if it means paying rent to CAs every year so they can sit on their fat ass and do nothing.
Did you miss the part about being able to obtain certs either very cheaply or free? Nice to see that you remove my link to HTTPS everywhere. EFF has been advocating SSL everywhere for years...so we can stop with the its only Google conspiracy BS.
The issues with performance were gone a decade ago...
Even if maintaining session state and TLS were completely free round trip delay and assuming the best case that session resumption occurs for all accesses you still have to eat additional round trips...delay that is quite noticeable to those accessing content internationally and over wireless or low bandwidth links.
What decade are you living in??? The only potential for any delay is on session establishment. For maximum performance and to minimize roundtrips , you should be keeping connections open rather than opening one on each request.
HTTP/1.1 came out in 1999, fifteen years ago! We now also have SPDY and websockets to improve things even more.
posts have been modded up.
Why should people have to screw with SSL when they have no secure content to offer? This is what makes no sense to me. Google is twisting arms to have their way.
Regardless of what you think of making everything "secure" I don't subscribe to the notion that ends should justify means.
Because it protects the people who read their content from getting their traffic messages. It also makes the spying more expensive. Have you been asleep for the last couple of years? Did you miss the Snowden thing?
Again, I don't understand why posts like yours have been modded up.
Step 1: Sign your own cert(s).
Step 1b (optional): Use certs signed in step 1 to sign additional certs.
Step 2: Publish the hash of the certs in step 1 in one or more widely-printed, widely-available newspapers or magazines.
Step 3: On your web site host installable copies of all certs made in steps 1 and 1b, text and photographic copies of the printed hashes from step 2, and instructions on where to find copies of these publications (e.g. "go to your local library and look up XYZ newspaper dated DATE MONTH YEAR and go to section X page P and look in the 2nd column about 2 inches down").
While most people won't go to the trouble of going to the library, the fact that it is fairly easily check-able by people with access to a big-city library will make it that much more difficult for someone to launch a MITM attack without being caught. Not impossible, just much more difficult.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Great illustration.
On my desktop, over the LAN, with caching forcibly disabled, HTTP took 5.3 seconds and was 9% slower than HTTPS.
On my mobile, over WiFi, again, with caching forcibly disabled, HTTP took 6.8 seconds and HTTPS took 10.8 seconds, 33% slower, AND instead of consumed 2 MB of data because caching couldn't be used.
On my mobile, over the cellular network, HTTP took 18 seconds, and HTTPS took 30 seconds, 69% slower, AND consumed 2 MB of data.
So, considering that mobile is huge and growing, THIS IS A DUMB IDEA.
-1 Uncomfortable Truth
What's it like getting your ass kicked by apk + downmodding to hide it 20x http://tech.slashdot.org/comme... ?
http "provides no data security"? You mean like Slashdot.org ?
Warning about all sites that don't use TLS is excessive. Many web sites gather no information (they may not even issue cookies) and there is no reason for the warning on those sites. Warning about the lack of TLS on pages that include input forms might be a reasonable compromise; not all of those actually gather any sensitive information (online entertainment quizzes, for example, unless they ask for your email address or the like) but there is no way for the browser to know that.
My hack would be that any non-secure website would have its background image replaced at the browser end by a red warning background with a watermark "WARNING" embedded in it.
"There is no god but allah" - well, they got it half right.