Slashdot Mirror
Whitehouse Mandates HTTPS For Government Sites and Services
Bismillah writes: As per orders from Tony Scott, the government CIO, all federal agencies with publicly accessible websites must provide service only through a secure HTTPS connection. "Federal websites that do not convert to HTTPS will not keep pace with privacy and security practices used by commercial organizations, and with current and upcoming Internet standards," according to his memo. "This leaves Americans vulnerable to known threats, and may reduce their confidence in their government."
It's not like this is a new initiative, or that we didn't have dry runs a few years ago.
It's just a few recalcitrant holdouts being told: "Switch or Die".
-- Tigger warning: This post may contain tiggers! --
Commanding the NSA to continue violating the Constitution and sucking up our data despite the Supreme Court's ruling that it is illegal. And this is the same gov't that wants to weaken encryption... yet they want to use it at the same time.
So, we'll keep locking people in rape cages for growing plants, pulling guns on unarmed teens and going through security theater in air ports with a 90% detection failure rate....But finally I can do https://whitehouse.gov/ to vote on a bogus petition with no effect. My confidence is restored thusly.
--- Liberty in our Lifetime
Wait, I thought government as trying to fight encryption, not require it.
Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
and .edu, I'd guess.
Those are almost all state, local, or private. But there are a few run by the feds, such as www.usma.edu and www.usna.edu, which default to vanilla http.
Most .gov sites buy certs from normal CAs, like Thawte and Verisign.
And the requirement isn't for just HTTPS-only, but for also implementing Strict Transport Security and suggesting using Perfect Forward Secrecy.
Learning HOW to think is more important than learning WHAT to think.
A big question for .edu is do research universities that get large amounts of funding have to go https as well.
We know that this will apply to public-facing websites, so technically that would apply to a medical research hospital as part of a university (quite a few of those), but will it include small labs using fed grants as well? Presumably if external facing.
A lot of such websites, like a crystallography beam website, are internal only, so they don't count, but it's not that big a deal. However, most of the certificates for those belong to the institutions themselves, and not the usual public grantors.
-- Tigger warning: This post may contain tiggers! --
Just add the .gov and .mil top-level domains to HSTS preload lists. That'll close the code injection vector on port 80 before the redirect to HTTPS takes place. It also acts as a fire under all government sites - implement TLS or else HSTS browsers won't be able to access your site any further.
A big question for .edu is do research universities that get large amounts of funding have to go https as well.
Not because of this directive. Federal grants do not a federal agency create.
We know that this will apply to public-facing websites, so technically that would apply to a medical research hospital as part of a university
Public-facing federal websites. If you are a federally operated University, yes. Otherwise, no. USNA, USAFA, West Point, yes. UW, no.
MAKE UP YOUR FUCKING MINDS!
Obama: Gov't Shouldn't Be Hampered By Encrypted Communications
http://yro.slashdot.org/story/...
FBI's James Comey: the Man Who Wants To Outlaw Encryption
http://yro.slashdot.org/story/...
Meanwhile ./ got their HTTPS sliced and DICED away.
As I post this, it's plain text HTTP.
Obama's legacy: (N)othing (S)ecure (A)nywhere and (T)error (S)imulation (A)dministration
Can they mandate that all of the services their departments offer for employees for work play nice with the latest version of Java within X number of days after a new Java release? Can they mandate that their training stuff not use Flash, Silverlight, or some other non-standard garbage that causes issues for non-Windows users? Dumping Oracle Forms for a bunch of their purchasing systems would be swell, too. Switching VPN providers three times in two years, as well as a revolving door of AV clients is also kind of a drag, as is having several pieces of tech ram-rodded down our throats in emergency fashion, but never used again...The digital signature pad comes to mind.
Cheers,
One very annoyed Federal "IT Specialist"
Rather than take the time to understand their perimeter and data it exposes they want to "protect" everything with HTTPS. Which probably doesn't make sense for static, non interactive services.
Perhaps, but it also helps protect against content injection or manipulation (e.g. ad injection by shady ISPs), snooping by third parties (e.g. hotel or coffee-shop networks), etc.
Honestly, there's very little reason *not* to encrypt data these days.