Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Electronic Frontier Foundation Encryption Privacy Security The Internet

EFF Applauds 'Massive Change' to HTTPS (eff.org) 214

Posted by EditorDavid from the securing-your-future dept.
"The movement to encrypt the web reached milestone after milestone in 2017," writes the EFF, adding that "the web is in the middle of a massive change from non-secure HTTP to the more secure, encrypted HTTPS protocol." In February, the scales tipped. For the first time, approximately half of Internet traffic was protected by HTTPS. Now, as 2017 comes to a close, an average of 66% of page loads on Firefox are encrypted, and Chrome shows even higher numbers. At the beginning of the year, Let's Encrypt had issued about 28 million certificates. In June, it surpassed 100 million certificates. Now, Let's Encrypt's total issuance volume has exceeded 177 million certificates...

Browsers have been pushing the movement to encrypt the web further, too. Early this year, Chrome and Firefox started showing users "Not secure" warnings when HTTP websites asked them to submit password or credit card information. In October, Chrome expanded the warning to cover all input fields, as well as all pages viewed in Incognito mode. Chrome has eventual plans to show a "Not secure" warning for all HTTP pages... The next big step in encrypting the web is ensuring that most websites default to HTTPS without ever sending people to the HTTP version of their site. The technology to do this is called HTTP Strict Transport Security (HSTS), and is being more widely adopted. Notably, the registrar for the .gov TLD announced that all new .gov domains would be set up with HSTS automatically...

The Certification Authority Authorization (CAA) standard became mandatory for all CAs to implement this year... [And] there's plenty to look forward to in 2018. In a significant improvement to the TLS ecosystem, for example, Chrome plans to require Certificate Transparency starting next April.
This discussion has been archived. No new comments can be posted.

EFF Applauds 'Massive Change' to HTTPS More

EFF Applauds 'Massive Change' to HTTPS

Comments Filter:

  • Fix my ignorance (Score:5, Insightful)

    by Anonymous Coward on Sunday December 31, 2017 @05:52PM (#55840529)

    If a website doesn't take any private information from you why does it need ssl/tls?

    I'm just not understanding the push for everything to be encrypted when it doesn't need to be.

    • Re: (Score:3, Interesting)

      by Anonymous Coward

      It doesn't. Google just thinks they know better than you. Maybe making everyone dependent on certificate authorities even when they don't need it is part of their plan for world domination.

      • Re: (Score:3)

        by AmiMoJo ( 196126 )

        You can just use Let's Encrypt, or free CDN services like Cloudflare.

        For personal sites it doesn't matter, your Google rank will barely be affected, if at all. For anything else the bar is so low it's probably zero effort as you wanted the CDN anyway or need at least some secure pages for log in etc.

      • Re: (Score:2)

        by tepples ( 727027 )

        Effectively everybody is already dependent on domain registrars.

    • Re: Fix my ignorance (Score:3, Insightful)

      by Anonymous Coward

      Because my little brother, guy sitting next to me at Starbucks, my ISP, and government don't need to have a clear text view of everything, or anything, I'm doing. It's not that I'm doing anything wrong... It's that it's none of their fucking business.

      • Re: (Score:3, Informative)

        by AmazingRuss ( 555076 )

        ... and they have no interest whatsoever in your fucking business.

        • Re: (Score:2, Insightful)

          by Anonymous Coward

          ... and they have no interest whatsoever in your fucking business.

          That's not the point.

        • Re: Fix my ignorance (Score:5, Informative)

          by Anonymous Coward on Sunday December 31, 2017 @10:17PM (#55841537)

          Maybe they don't right now, or in a year, or 10 years, or maybe never.
          But maybe, at some point, whoever is in control of that data decides they want to smear you by cherry picking the sites you've visited. Or maybe they use it to build a court case against you. Or maybe they use it to watch out for "dissidents" or those who won't submit to a dictatorship.

          Would you want to live in a society where the gov knows exactly where you've gone and what you've done both historically and in real time? The US is dangerously close to this stage already.

          HTTPS makes it just a little harder for them to do this. Does it solve every security and privacy problem? No, it sure doesn't, but it's a step in the right direction.

          A democracy dies when it's people become too complacent to demand their rights be recognized.

        • Re: Fix my ignorance (Score:5, Insightful)

          by lgw ( 121541 ) on Sunday December 31, 2017 @10:22PM (#55841563) Journal

          Until you speak out politically. Until you're photographed at a protest. Until you're a nuisance to those in power. Then you may find that you want the government to not have low-effort ways to attack you.

          Remember, there's no telling what topics that are innocuous today will become reputation-wrecking or outright illegal in 20 or 40 years, and the government has a habit of keeping everything in case it might be useful one day.

          Never assume that because the government has no interest in you today, that because you're not doing anything sketchy today that today's actions can't be used against you. And never assume that the government isn't recording everything.

          Anyhow, https is nearly free - why shouldn't it be used everywhere all the time? Low cost for potentially massive benefit.

          • Anyhow, https is nearly free - why shouldn't it be used everywhere all the time?

            Because don't CAs don't issue certificates for 192.168/16 or the mDNS reserved domain (.local), HTTPS between devices on your LAN requires either buying a domain or running your own CA and installing its root on all devices on your network. The latter is difficult on many platforms.

            • >Because don't CAs don't issue certificates for 192.168/16

              Which is good.

              >unning your own CA and installing its root on all devices on your network. The latter is difficult on many platforms.

              So if you want security don't buy shitty devices that don't allow you to install certs from your own CA. You are on this strange rant about SSL on the local network. Just fucking ignore the error on your local network.

              • Re: (Score:2)

                by tepples ( 727027 )

                So if you want security don't buy shitty devices that don't allow you to install certs from your own CA.

                Good luck walking friends and family visiting your home through trusting your private CA in order to access your printer and videos on your NAS.

                • If they _want_ the printer or videos, they'll do it.

                  If not, too bad, they clearly didn't want it enough.

        • Until they do.

          And most of the time it's still none of their fucking business.

      • Is the clear text view any less revealing than the DNS lookups or the initial requests (which I assume have to be specify in clear-text to start the exchange?) I get that some subpages may be sensitive, but I'd imagine that's "personal data" that GP was referrring to.

        • Re: (Score:2)

          by tepples ( 727027 )

          The ClientHello shows only the domain name, not the particular path within the domain. For example, it shows only that you visited WebMD, but the identity of particular document you are viewing is encrypted. All an eavesdropper can do is traffic analysis on approximate document lengths, and there are mitigations for even that.

    • To make hiding the malware easier. Slow no caching (Score:5, Informative)

      by raymorris ( 2726007 ) on Sunday December 31, 2017 @06:03PM (#55840589) Journal

      In my professional judgement, there is little benefit to https for many sites, which simply present publicly available information. This is based on my 20+ years of internet security work throughout my career. Payment pages where people enter credit card information obviously need encryption, but in my opinion most sites see little to no benefit.

      Https means it can't be loaded from your ISP or company's cache, making popular sites slower. It also prevents corporate security or your own router / firewall from seeing the malware or whatever that some hacker added to the page, and generally keeping an eye out for security problems. For public sites where you don't log in, I think https is a net reduction of security.

      There *is* the argument that it makes it harder for governments to know which pages you're viewing on a site, but they still see which sites you connect to.

      • Re:To make hiding the malware easier. Slow no cach (Score:5, Insightful)

        by suutar ( 1860506 ) on Sunday December 31, 2017 @06:46PM (#55840797)

        As I understand it, corporate security has the option of having you accept their keys and MITMing everything, allowing scanning and caching of activity performed from inside the corporate network. Is that incorrect?

        • As I understand it, corporate security has the option of having you accept their keys and MITMing everything, allowing scanning and caching of activity performed from inside the corporate network. Is that incorrect?

          Indeed. And with HTTPS, corporate security can ensure that they're the only ones MITMing the connection. With HTTP it's impossible to know if anyone else might be monitoring -- or even modifying -- the connection.

        • That is an option. If corporate administers the computers, they can install a cert onto every computer which lets them (and anyone who gets their key) mitm ALL otherwise secure connections. Meaning NO connection is secure.

          Personally, that seems to me a high cost to pay. My preference is that my employer's firewall can keep an eye out for malware added to public sites, but they don't mitm my secure connections and see the content of my personal Gmail, or my banking passwords.

          I prefer to apply rules appro

          • Given you have no way of knowing what your work are doing, I wouldn't do anything on a work device that I didn't want my IT department seeing. Meaning I'll use my mobile phone to do all those things.

            • Re: (Score:2)

              by tepples ( 727027 )

              I wouldn't do anything on a work device that I didn't want my IT department seeing. Meaning I'll use my mobile phone to do all those things.

              Connecting your mobile phone to work Wi-Fi would put your mobile phone behind the same proxy.

            • I do know what corp sec is doing. I know which products they use, and many of them are in-house, so I have the source code. (We're a security company, and eat our own dog food.)

              Anyone reasonably competent can see if their employer has pushed a trusted certs that allows them to mitm all TLS connections. My last two employers have not.

          • Our IT at work is about to start doing that - they promise it is only to detect malware traffic, and they'd never look at banking info or anythign health related.

            I've also found that they'll be doing the same for any SSL based VPN... so it looks like SSH tunnel time for me....

      • Re:To make hiding the malware easier. Slow no cach (Score:5, Interesting)

        by phantomfive ( 622387 ) on Sunday December 31, 2017 @06:59PM (#55840859) Journal
        Worth emphasizing that any time you have a user login, you should probably be using https to protect your cookies from then on, otherwise the cookies can be hijacked with a bunch of different methods.

      • Re:To make hiding the malware easier. Slow no cach (Score:4, Informative)

        by Graymalkin ( 13732 ) * on Sunday December 31, 2017 @08:33PM (#55841223)

        So you've got 20 years of professional experience yet don't recognize the dangers of MITM attacks from non-HTTPS pages?

        For public sites where you don't log in, I think https is a net reduction of security.

        If you are connecting to an unprotected page basically nothing on it can be actually trusted. While a page might look normal every resource and link could have been rewritten to do something malicious. You have no way of knowing that anything loaded over HTTP is what the server actually intended to send.

        Links could route through fishing sites and malicious resources could be added. One of the best features of HTTPS is to make resources resistant to MITM attacks. An page with no PII can be intercepted and modified to leak that data without you even knowing.

        Most people don't want or need their ISP or corporate gateway caching content. For one a browser's cache is more effective for most content since it's loaded from disk (or RAM) rather than coming over a network. Second it's more effective for ISPs to forego their own caching and simply let CDNs with their colocated edge caches handle the task. The content from the CDN to client is going to be encrypted using the source site's credentials (or authorized credentials) so end users can trust the data path to the server and the ISPs don't need to pay for the hardware. Since CDNs colocate edge caches everywhere they can afford there's little if any performance difference between a third party edge cache to the client and an ISP's edge cache to a client. They're likely to be hosted in the same buildings on the same networks.

        • Second it's more effective for ISPs to forego their own caching and simply let CDNs with their colocated edge caches handle the task.

          Provided your ISP can afford a large enough uplink to the Internet to reach the CDN's nearest edge cache. Say you operate IT for a school in sub-Saharan Africa behind an ISDN (0.13 Mbps) connection to the Internet, and you want to let all 25 students in a particular classroom read a particular Wikipedia article. The CDN's nearest edge cache is on the other side of your connection. Under cleartext HTTP, your caching proxy could retrieve the article once on behalf of all devices on the network and then serve

      • In my professional judgement, there is little benefit to https for many sites, which simply present publicly available information. This is based on my 20+ years of internet security work throughout my career. Payment pages where people enter credit card information obviously need encryption, but in my opinion most sites see little to no benefit.

        Https means it can't be loaded from your ISP or company's cache, making popular sites slower. It also prevents corporate security or your own router / firewall from seeing the malware or whatever that some hacker added to the page, and generally keeping an eye out for security problems. For public sites where you don't log in, I think https is a net reduction of security.

        There *is* the argument that it makes it harder for governments to know which pages you're viewing on a site, but they still see which sites you connect to.

        Why don't you come connect to my wifi hotspot, and log into all your sites unencrypted? I'll even cache the pages for you so reloads are faster. Even better, you can use my local DNS server.

        Oh, you don't want to connect to my hotspot? Well why not just connect to your home wifi network, that just magically appeared at Starbucks.

      • Comment removed (Score:4, Insightful)

        by account_deleted ( 4530225 ) on Sunday December 31, 2017 @08:48PM (#55841267)
        Comment removed based on user account deletion

      • In my professional judgement, there is little benefit to https for many sites, which simply present publicly available information.

        Your professional judgement is wrong, because you're only looking at half of what HTTPS provides. Encryption is only one of the things HTTPS provides, and it's arguably the less important one. Integrity is the more important one. HTTPS ensures that you're connecting to the site you think you are, and that the content it provides arrives at your browser unmodified.

        Without this, if a malicious party can get access to your connection at any point between your browser and the server they can make arbitrary mo

        • The integrity aspect of TLS is a important, that's a good point. In many cases where there isn't PII involved it doesn't matter much - the RC drone page where I'm reading about quadcopters is more likely to be hacked or have malicious code / ads than it is to be MITM, but it's something worth considering. The question is "which is a more likely threat, a mitm or a hacked WordPress?" I can tell you a hacked WordPress plugin occurs thousands of times more often than a malicious mitm, so content inspection wi

          • . The question is "which is a more likely threat, a mitm or a hacked WordPress?"

            That question is irrelevant. There's a simple way to eliminate the former threat, so it should be eliminated.

            Mitm by Corp sec is an option. If corporate administers the computers, they can install a cert onto every computer which lets them (and anyone who gets their key) mitm ALL otherwise secure connections. Meaning NO connection is secure. Corpsec then sees your personal email, your banking password, etc - as does anyone who gets the corporate cert.

            So... your argument is that it's so important that they be able to scan incoming traffic for malware that HTTPS shouldn't be used... but they shouldn't be able to scan HTTPS traffic for malware? Please make up your mind.

            You are normally smart enough to have interesting conversations in which you recognize that other people, people with decades of experience in their field, can see something differently than the way you see it.

            I didn't directly address your implied argument from authority and instead just explained why you were wrong. If you want to continue invoking that fallacious argument, though, I'll

      • Re:To make hiding the malware easier. Slow no cach (Score:4, Insightful)

        by AmiMoJo ( 196126 ) on Sunday December 31, 2017 @10:00PM (#55841497) Homepage Journal

        Not just governments spying on you, but your own ISP and advertisers too. We have already seen lots of ISPs doing MITM attacks that insert unwanted content into pages.

        Being able to see that you connected to Wikipedia is very different from being able to see that you looked at the Wikipedia page on STDs or pressure cookers or Casio watches.

        Organisation level caching is overrated these days anyway, since so much content is dynamic anyway. The benefits far outweigh the costs, especially considering that people who really need caching can just install their own certificates on their undoubtedly centrally managed computers.

      • You missed the other advantage, even though you stated it. It can't be served up by a (potentially modifed) "cache". It's about integrity as well as privacy.
      • Sure HTTPS prevents MITM attacks from compromising your browser, but for most sites it does nothing to hide what you are browsing. Crawl a site and fingerprint the packet size and timing of requests, and you can easily compare that a captured trace of your target.

        • Re: (Score:2)

          by AmiMoJo ( 196126 )

          Doesn't work very well these days, for a lot of sites. HTTP 2 allows requests to be pipelined on one connection, with compression. With dynamic content and browsers selectively blocking certain content (mostly ads) it gets tricky.

          Having said that, it would be a good idea to randomly pad packets.

      • If you work in security, I really hope I never have to deal with any of the companies you've worked for.

        Https means it can't be loaded from your ISP or company's cache, making popular sites slower

        Talk to ISPs. This was a huge deal 10-15 years ago, when the popular subset of the Internet was small enough to fit into caches. Now, the vast majority of fetches miss in caches anyway and a lot of ISPs have stopped running them. With a fast link, the overhead of having to do two TCP handshakes (one to the cache, then one from there to the real site when it misses) plus the latency of forwarding the res

      • There is little hard to sending everything over HTTPs and it takes users (who won't know any better) out of security decisions. Everything's encrypted. They don't have to think. "Well, I'm only entering what high school I went to. Do I care if this is http or https?" The downsides of forcing https are minimal and it eliminates human error from the security equation.

      • " there is little benefit to https for many sites, which simply present publicly available information. "

        The benefit is for users, not sites.

        Snoopers can still collect metedata about what connections you're making (and what DNS queries you made. HINT!), but they can't see the content of what you're accessing.

        One of the lessons about crypto is that if you only encrypt the sensitive stuff then anything encrypted is a big red "kick me" flag for a snooper and the're likely to keep the raw packets around until t

    • One motivation is to make it more difficult to distinguish important and sensitive information from wasted bandwidth, which makes it harder to censor. Of course, since the destination is known at the IP layer with HTTPS, that's of somewhat limited value.

      Of more value is ensuring that all your traffic goes over a VPN.

    • That's correct. A lack of understanding is at the root of your confusion.

    • Because private is better. Do you want people to monitor your traffic?

    • Re: (Score:2)

      by AHuxley ( 892839 )
      The Snowden news showed the security services got to collect it all along the different networks globally.
      With more HTTPS that easy plain text collection should have got more difficult.
      It was felt collection would have to be at the origin or destination with HTTPS.
      No more free way to see a search term, the context of using a HTTP site globally.
    • HTTPS prevents a malicious ISP/WiFI provider from intercepting all HTTP traffic and changing selected parts. e.g. inserting their own adverts instead of the original adverts or even inserting ads where there were no ads. It's also easy for someone to change the content of HTTP pages.

    • Re: (Score:2)

      by tepples ( 727027 )

      The path and query string of the specific document you are visiting is itself private information. If, for example, it's a document on WebMD about a particular medical condition, your interest in the condition can be used against you or your family.

      HTTPS also provides authentication that an intermediate actor didn't tamper with the connection. Comcast is known to inject advertising scripts into HTML documents delivered through cleartext HTTP.

  • You know a technology is really ubiquitous when even a tech news site switches to it. Maybe, perhaps, I will see working Unicode on Slashdot within my lifetime. For dig -t AAAA slashdot.org returning something else than NXDOMAIN, though, my hopes are not so high.

    • dig -t AAAA slashdot.org returning something else than NXDOMAIN, though, my hopes are not so high.

      What do you mean by that? If I do it I get

      $ dig -t AAAA slashdot.org

      ; <<>> DiG 9.8.3-P1 <<>> -t AAAA slashdot.org
      ;; global options: +cmd
      ;; Got answer:
      ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31874
      ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

      ;; QUESTION SECTION:
      ;slashdot.org. IN AAAA

      ;; AUTHORITY SECTION:
      slashdot.org. 300 IN SOA ns0.dnsmadeeasy.com. hostmaster.slashdotmedia.com. 2016045555 14400 600 6048

      • Re: (Score:2)

        by Vairon ( 17314 )

        What they mean is Slashdot still doesn't support IPv6. Note the ANSWER: 0 under flags and the lack of an actual answer. Compare the output seen performing the same DNS query for www.google.com.

        If you were being pedantic then yes technically now it returns NOERROR instead of NXDOMAIN.

  • Now if browsers would isolate resources (Score:3)

    by HalAtWork ( 926717 ) on Sunday December 31, 2017 @08:39PM (#55841235)

    Now if only browsers would isolate resources from third party web sites so they can't scrape info from other parts of the page or grab keyboard/mouse input, and allow per-page access to certain hardware like mic/camera/filke system, then it would go much further.

    Https stops ISPs and nodes from tapping info, but a lot of third parties end up with all of that anyway.

  • Just the fist step (Score:2, Insightful)

    by Anonymous Coward

    You just watch. In five years the major Web sites, having switched to HTTPS-only, will require personal SSL certificates to use their services. You think Google and Facebook track you now? Just wait until they can tie a browser session with your personal identity with virtual certainty.

    • That isn't how SSL/TLS work. There is no "client" certificate. You are an uneducated conspiracy theorist.
      • Actually part of the SSL standard does allow for client side certificates and TLS has the same functionality. It is rarely implemented for a variety of reasons which all come down to "because it is hard".

      • Re: (Score:2)

        by lokedhs ( 672255 )
        Sure there is: Wikipedia [wikipedia.org]

        That said, places like Google and Facebook already make it very hard to access their services even withouth client certificates. Have you tried just doing a google search via Tor lately?

      • There are client certificates and they've been supported by all major browsers for well over a decade. There's also a standard for generating them from JavaScript, which is less well supported, but is quite a nice way of doing client authentication (after first login, create a client cert and register it for use on that site and you never need to transmit the password from that computer to the server again).

        That said, the most common implementation is to have a different client cert for each service, so i

    • Re: (Score:2)

      by AmiMoJo ( 196126 )

      Sounds like suicide. Normal people will never figure out managing certs over all their devices, for example. And talk about making it hard for users to discover your services. Aside from things like email, most Google stuff works without login, even over Tor and without JavaScript.

  • How was HTTPS changed? (Score:3)

    by Dan East ( 318230 ) on Sunday December 31, 2017 @09:48PM (#55841463) Journal

    Exactly what was this massive change to HTTPS? Was HTTPS insecure in some way and needed to be fixed? Oh wait, what you probably meant was EFF Applauds 'Massive Adoption' of HTTPS.

Slashdot Top Deals

Beware of Programmers who carry screwdrivers. -- Leonard Brandwein

Close