Hacker News Reader

Comment by ars | Hacker News Reader

I'm unclear about what the problem is.

So the traffic is encrypted. How does that make anything worse?

It seems pretty irrelevant to me if it's encrypted or not.

Indeed, trendmicro doesnt say anything about that. Let's Encrypt says "The concern most commonly expressed is that having valid HTTPS certificates helps these sites look more legitimate, making people more likely to trust them." I agree with Let's Encrypt position, they are not to blame here.

https://letsencrypt.org/2015/10/29/phishing-and-malware.html

Exactly. This false notion of security was perpetuated by CAs for marketing purposes. It's their fault if users now mistakenly think HTTPS == trustworthy.

They basically sold certs as something they're not and now complain that people may realize they don't actually serve that purpose now that they're made widely available without the false pretences.

Not 100% sure, but if the malicious ad is put on an HTTPS page, it would not be possible to load additional scripts and data from an un-encrypted (HTTP) location as opposed to another valid HTTPS location. Having your malware on an HTTPS site goes around the browser's mixed content restrictions.

You could just as easily register a separate domain and use HTTPS on that if your goal is to inject scripts in the background. The "problem" being reported here is that the user may think the site is not going to send them malware because it has a green padlock in the address bar

Maybe because it can't be automatically detected by some layer 7 firewall filters/web proxies.

Although some seem a bit squeamish about it, any good firewall/filtering solution should do SSL MITM --- especially now that encrypted connections are becoming the norm.

Given that Trend Micro themselves provide AV software that does this, it's particularly ironic since it's already no problem for them to decrypt and scan encrypted traffic. It's likely just their CA division that dislikes Let's Encrypt.

Reply on news.ycombinator.com