Slashdot Mirror
WordPress.com Enables HTTPS Encryption For All Websites
On Friday, WordPress announced that it is bringing free HTTPS to all -- "million-plus" -- custom domains, essentially ramping up security on every blog and website. The publishing platform says it partnered with Let's Encrypt project to implement HTTPS across such a voluminous number of sites. From the blog: For you, the users, that means you'll see secure encryption automatically deployed on every new site within minutes. We are closing the door to un-encrypted web traffic (HTTP) at every opportunity.
smart move, monkeys
"Hopefully Talking To People Securely" (sorry by the joke, but it was stronger than me :P)
Sadly this probably means tons of mixed content security errors are about to start happening. Everybody who linked to an image in their blog with the full URL (http://site.com/image.png) will have images that used to load with no problem start throwing up security errors. I had this problem when I got the Let's Encrypt certificate for my blog. Had to go back and change all the images I had loaded in my previous posts to use my new https URLs. Fortunately, I don't post often so there weren't too many...
Life has many choices. Eternity has two. What's yours?
Great all sites that should have been "static" are sent over encrypted channel while WP is still a Swiss cheese.
Will this help reduce the severity of that slew of vulns that seems never ending??
I just heard "You're going to be getting a lot of calls from people because Let's Encrypt isn't a CA they trust, and instead of it just being encrypted, people will think it's broken."
Your ad here. Ask me how!
Sure, HTTPS is good and all, but it won't help back-end flaws.
No levels of encryption will help that. It might make things harder to understand. For now. But it won't eliminate the flaw.
Never trust any input from a user. Doesn't matter if it is an IP or referrer, user-agent of browser version.
Everything from a user is potentially malicious. Secure it, wrap it, nullify escape sequences, whatever you need.
Wordpress already had an issue with this previously if I remember correct, where user-agents were stored as-is in a DB, which was being used to hack in some way. (I forgot how it worked, it was a while back)
The Let's Encrypt intermediate certificates are cross-signed by IdenTrust, an established CA. From which major web browser's default certificate store is IdenTrust missing?
[...] today, TLS encryption of HTTP causes latency increases of a statistical 5mS at worst [...]
Five milli-Siemens?
* https://en.wikipedia.org/wiki/Siemens_(unit)
"s" is the SI symbol for seconds.
of encrypting 99.99% of blog traffic, when that traffic - the blog posts - is visible to the whole Internet anyway?
HTTP/2 might be the actual main motive for this switch. HTTP/2 is more efficient than HTTP/1 but requires TLS encryption.
Indeed, wordpress.com does offer HTTP/2:
url="https://www.wordpress.com" /dev/null "$url" 2>&1 |grep ALPN
curl -v --http2 -I -o
* ALPN, offering h2
* ALPN, offering http/1.1
* ALPN, server accepted to use h2
In 1998, a security- conscious person would sanitize input, and blacklist certain characters. strip_slashes(), quote_meta() and friends were best practice.
Today, there are so many well-known ways around that using different encodings and such, it's virtually impossible to do securely. Instead, today we recognize that user input is potentially malicious and treat it that way - forever. It's NEVER considered sanitized , because it never can be. That means when storing data to a database, we use bound parameters, never interpolated strings. User input can't be used for sql injection because the input isn't part of the query, it's a data parameter that the query carries. On output, encode.
In other words, the user agent SHOULD be stored as-is in the database, because it can't possibly be made clean. Just remember that and don't echo it straight to the html output. Encode it first because it's binary data of unknown origin.
Took you assholes long enough. Even de-facto dead 90s roadkill sites like slashdot had already made this switch.
Of course, being encrypted doesn't mean a thing. WordPress is swiss cheese security, always has been and always will be.
While HTTPS encryption is nice in terms of privacy (someone listening in on your line now only knows which server you talk to, instead of what you talk about), it kills the utility of proxies like squid. At a local school it was, before YouTube went encrypted by default, possible to have a whole class open a video - which is now history since their downlink isn't big enough to deliver 30 videos in parallel (instead of one which could be cached and distributed locally).
It is a big step back for them, sadly.
That as a value added service, with per year costs they could add onto low upfront priced hosting and domain packages.
Domestic spying is now "Benign Information Gathering"
Now "secure" because it is hidden behind HTTPS? If your employer wasn't doing HTTPS interception before they sure as heck better be doing it now.