Hacker News Reader

Hacker News

Comment by Goopplesoft | Hacker News Reader

Full thread

Goopplesoft

Why is root-servers.org not https?

View on HN

You transmit no secret information to it, and it none to you?

But how do I know the information it sends to me hasn't been MITM'd if it isn't SSL'd?

Sure. Fair. : )

But if you don't have DNS how do you download the revocation list?

How is a system with at least the ability to validate the origin but without repudiation worse than a system with absolutely no security at all.

And you don't mind if the traffic is intercepted and modified?

.....Why would it be?

to protect a visitor's privacy

Or to ensure that the content is not tampered.

Nobody would tamper with this content.

That's not actually true. There have been several documented examples now of people injecting stuff into HTTP requests when they pass by (ISPs injecting notifications, ads, people running proxies injecting malicious javascript, etc).

It's completely true. This content would never be targeted for MITM.

It's a dashboard for displaying the global locations of DNS root servers and links to their authoritative organizations. Not only is this an incredibly niche site, all DNS root server information is replicated around the world by multiple organizations. Nobody uses this site to maintain their DNS trusts, it probably gets incredibly low traffic, and going out of your way to MITM it would be a lot of work for no payoff. This is a terrible target. Nobody would bother.

It's not strictly about targeted attacks. There are people who modify unencrypted content that passes through their system regardless of what content it is. There have been several presentations on this topic, but I'll link the slides for one [0]. Here's an article about an ISP injecting ads in case you don't think this sort of thing happens in real systems [1].

[0] https://www.defcon.org/images/defcon-17/dc-17-presentations/...

[1] http://arstechnica.com/tech-policy/2013/04/how-a-banner-ad-f...

China injected javascript malware into non-https traffic that joined the users into a botnet that launched a DDOS attack on Github. The "Great Cannon".

The "Great Cannon" only targeted foreign traffic destined for Chinese websites. This one is not.

Yes but they just as easily could have targeted traffic to this site as well.

Also a number of ISPs and wifi hotspots inject ads, and I know Verizon injected a tracking header based on your mobile plan.

So Verizon is going to inject some 0day malware into this page to, what, serve you more ads?

If you're concerned about tracking cookies or headers, get a plug-in to stop it. Every website on the planet should not need to use https just because Verizon wants to make money off targeted ads.

And nobody is attacking this page to hack individuals. Of course you can. Security isn't about preventing every single possible attack from every possible angle. It's about making attacks more difficult when one is plausible or likely. Nobody will attack you through this particular website. So https is not needed to prevent a targeted attack.

What privacy? Your IP and the hostname of the website you're connecting to isn't encrypted over HTTPS anyway. The content isn't sensitive and there's no cookies on the site. The only remotely personal data would be your accept language header (which could be guessed from your IP) and user agent string (which you can just spoof anyway if you're really that paranoid).

The MITM argument has more merit, but even there I can't see it making much difference here given it's niche appeal. Plus given it's tech-savy bias, most people will be running a reasonably hardened system (latest patches, et al) anyway. Not the best argument against running TLS I'd admit; but still a point worth raising since the only argument for running HTTPS is to prevent malware injection.

Obviously in an ideal world everything would be served under TLS. But let's be pragmatic about which sites we bully into switching.

Your IP and the hostname of the website you're connecting to isn't encrypted over HTTPS anyway.

AFAIK website hostname is visible when using SNI.

Indeed, but SNI is more than 10 years old now so very well supported. I'd appreciate someone else correcting me if I'm wrong here, but I believe SNI is also enabled by default (where it's supported).

In any case, even without the hostname header, it doesn't take much research to find a short list of possible candidates (eg https://www.virustotal.com/en/ip-address/193.0.6.136/informa...).

Thanks for going deep into this, let me add though that it's not about an ideal world or bullying, HTTPS should be the default. Lets Encrypt managed that for us already, pretty soon it will be the default.

Reply on news.ycombinator.com