Life Is About to Get Harder for Websites Without HTTPS(troyhunt.com)
troyhunt.com
Life Is About to Get Harder for Websites Without HTTPS
https://www.troyhunt.com/life-is-about-to-get-harder-for-websites-without-https/
351 comments
I hope lans are exluded? I'm scared that I will get security warnings everywhere in my lan.
- when I log in to my webcams it says the connection is not secure
- when I log in on my nas it says the connection is not secure
- when I log in on my router it says the connection is not secure
- when I log in on the web interface of mythtv it says the connection is not secure
- when I log in on my self hosted gitea instance it says the connection is not secure
- when I log in to my self hosted nextcloud it says the connection is not secure
- when I log in to the configuration page of my toaster it says the connection is not secure
All these things are on my lan, and on most things there is no way to install a tls cert on them, nor would I want to do that.
Firefox already nags me that the connection is not secure when i enter a username and a password in any of those sites.
- when I log in to my webcams it says the connection is not secure
- when I log in on my nas it says the connection is not secure
- when I log in on my router it says the connection is not secure
- when I log in on the web interface of mythtv it says the connection is not secure
- when I log in on my self hosted gitea instance it says the connection is not secure
- when I log in to my self hosted nextcloud it says the connection is not secure
- when I log in to the configuration page of my toaster it says the connection is not secure
All these things are on my lan, and on most things there is no way to install a tls cert on them, nor would I want to do that.
Firefox already nags me that the connection is not secure when i enter a username and a password in any of those sites.
Serious question: if I just run a simple blog with static HTML hosted with Apache, do I really need HTTPS? Will I be penalized by not having it?
HTTPS is pain in the neck and _currently_ I hate it from the bottom of my heart.
TLTR: if you have a commercial service or device running in a local network forget HTTPS and service workers, use HTTP and HTML5 appcache.
-- RANT starts here --
It would be lovely when every website and webapp uses HTTPS. But for a significant amount of them it's just not f..... possible without driving users completely insane.
If the HTTPS server doesn't (and never will) have a public domain forget about encryption and security, forget about using service workers. The following examples can't, by the love of god, ever provide HTTPS without completely f..cking up user experience due self signed certificates warnings:
1) internal corporation services, websites and webapps.
2) services that run in a local private network like on a Raspberry Pi.
3) webapps which are served via public HTTPS website, but need to talk via CORS to local unsecured services, like to a Philips hue bridge, or any other IoT device which is in the local network but only provides HTTP. These will enlight the users with a shiny mixed-content warning.
.... JUST use self-signed certificates, they said.
NO.
For normal users the UX of self-signed certificates is just non existent, it's a complete mess! It will scare the sh't out of users and will almost always look like your service is plain malware.
It looks much more secure to serve a good'ol HTTP site with no encryption at all.
TLTR: if you have a commercial service or device running in a local network forget HTTPS and service workers, use HTTP and HTML5 appcache.
-- RANT starts here --
It would be lovely when every website and webapp uses HTTPS. But for a significant amount of them it's just not f..... possible without driving users completely insane.
If the HTTPS server doesn't (and never will) have a public domain forget about encryption and security, forget about using service workers. The following examples can't, by the love of god, ever provide HTTPS without completely f..cking up user experience due self signed certificates warnings:
1) internal corporation services, websites and webapps.
2) services that run in a local private network like on a Raspberry Pi.
3) webapps which are served via public HTTPS website, but need to talk via CORS to local unsecured services, like to a Philips hue bridge, or any other IoT device which is in the local network but only provides HTTP. These will enlight the users with a shiny mixed-content warning.
.... JUST use self-signed certificates, they said.
NO.
For normal users the UX of self-signed certificates is just non existent, it's a complete mess! It will scare the sh't out of users and will almost always look like your service is plain malware.
It looks much more secure to serve a good'ol HTTP site with no encryption at all.
Off-topic: If only IPv6 adaptation would have as much momentum as HTTPS.
I wish people would stop equating "secure" with "HTTPS".
I hope they did some user testing to see how people actually behave in the presence of such warnings but in my experience it does nothing. Worse, it's in an environment that is already rife with little messages in corners trying to get your attention (ads) so users may be more "blind" when browsing than usual.
The success of "Let's Encrypt" suggests that a key part of the problem wasn't a lack of user complaints about security. Rather, it was a lack of a sane model (both technically and economically) for setting up and maintaining certificates. In the end, people maintaining sites already had 100 other things to worry about and weren't going to get around to HTTPS with anything less.
The success of "Let's Encrypt" suggests that a key part of the problem wasn't a lack of user complaints about security. Rather, it was a lack of a sane model (both technically and economically) for setting up and maintaining certificates. In the end, people maintaining sites already had 100 other things to worry about and weren't going to get around to HTTPS with anything less.
With Cloudflare's first easy to use free SSL and later Lets Encrypt, I think it there are no more excuses for not being secure.
How is a gateway serving a configuration page at 192.168.1.1 to internal users supposed to eventually get an HTTPS certificate for that address...?
I deploy ssl on all my sites, but imo the article is way overestimating the importance of browser notifications.
How about a warning in Chrome that says "You're about to use Chrome to visit this website, and thus send everything about yourself to Google to do whatever they want with", for all websites staring in Chrome ~67?
How hard is it to provide HTTPS these days?
Say you have a plain Debian 8 install, running a typical LAMP stack serving a single domain.
If you want to make it use a LetsEncrypt cert and serve the domain over HTTPS - what would be the minimum number of steps on the command line to make it do that?
Say you have a plain Debian 8 install, running a typical LAMP stack serving a single domain.
If you want to make it use a LetsEncrypt cert and serve the domain over HTTPS - what would be the minimum number of steps on the command line to make it do that?
[deleted]
I have been anticipating this but have had better things to spend my limited time on. I have more than 135 sites I need to convert to https and they are load balanced. I don't think letsencrypt handles load balanced sites yet. My management is against wildcard certs. This might push them over the edge in favor of wildcard certs.
HTTPS gives your ISP less of your information to collect, analyze and sell to advertisers which in turn protects the value of Google's information about you. I think the changes to Chrome are well-intentioned, but can't help but smile at how this side-effect favors Google's business.
Here's another take on how much of the web is HTTPS:
https://truemarketshare.com/report?id=https
https://truemarketshare.com/report?id=https
Bleh. Wish I could use ssl on my GitHub pages site with custom domain.
what about self signed certificates? wouldn't it be great if these swebsites treated like http ones, without any security flags
Bit of a scare tactic. Page is an ad for Mr. Hunt's $299 course.
It's all true. However, I would make the case for Pat Q. Mainstream feeling less alarmed by "Not Secure" messages than most HN readers.
Note the Twitter example is from Mr. Hunt, not a random internet user.
It's all true. However, I would make the case for Pat Q. Mainstream feeling less alarmed by "Not Secure" messages than most HN readers.
Note the Twitter example is from Mr. Hunt, not a random internet user.
Imagine someone who knew enough to set up a site on his own server a long time ago and had left it alone ever since. Maybe he'd considered turning it off a few times, but just couldn't be bothered to. Now he suddenly gets contacted by a bunch of people telling him his site is "not secure". Keep in mind that he and his visitors are largely not highly knowledgeable in exactly what that means, or what to do about it. It could push him over the edge.
...and then there's things like http://www.homebrewcpu.com/ which might never have existed if HTTPS was strongly enforced all along.
I understand the security motivation, but I disagree very very strongly with these actions when it also means there's a high risk of destroying valuable and unique, maybe even irreplaceable content. In general, I think that security should not be the ultimate and only goal of society, contrary to what seems the popular notion today. It somewhat reminds me of https://en.wikipedia.org/wiki/Slum_clearance .
(I also oppose the increased centralisation of authority/control that CAs and enforced HTTPS will bring, but that's a rant for another time...)