Comment by cj | Hacker News Reader

Comment by cj | Hacker News Reader

I look forward to a HTTPS-only world some day to prevent MITM issues like the original article, but we have a ways to go.

I run a service that involves adding Javascript to a site (like you would with Google Analytics). At one point we were serving 100% of scripts / APIs via SSL, but ended up moving to matching the origin host's protocol because customers were complaining of older version of IE that actually block HTTPS requests that originate from HTTP pages.

So now we serve API calls matching the protocol of the domain the script is loaded on.

It's been on our mind to go back and figure out exactly which browsers this affects, implement browser detection logic, and then serve SSL APIs for everyone else. Although it's a bit tricky when supporting customers who have users (still) accessing them with obscure / old browsers.

More broadly, Let's Encrypt has been a great initiative. AWS WAF is also great for generating certs easily (although only inside AWS unfortunately with specific AWS services). Initiatives encouraging people using legacy browsers upgrade to upgrade will also help companies like ours (and others) trying to support 100+ browser versions on various OS's.

For us, China has also been a slight issue. The firewall tends to add extra (unpredictable) latency for SSL requests, even when engaging with firms for $xx,000 specializing in overcoming China networking related obstacles.

"customers were complaining of older version of IE that actually block HTTPS requests that originate from HTTP pages"

What what what? I've never heard of that particular IE weirdness. Do you know which versions have that problem - and is there any documentation anywhere?

You've really never experienced this? I've never gotten https Ajax requests to work from a page loaded under http in IE.

What you are describing is correct behavior for Ajax: an "origin" is defined by the domain/protocol/port tuple, and so http://www.example.com and https://www.example.com are the same origin.

What the parent comment is describing is a script tag which fails to load because its src is served over https instead of http.

Can you explain more? Does China capture ssl traffic or something similar?

China throttles lots of foreign websites that it doesn't block. It wouldn't be surprising if they target all foreign ssl traffic for throttling too.

In Beijing currently. I set up a SOCKS proxy through an EC2 instance and it seems to be throttled after 10 minutes of use -- to the point that Edge on my smartphone is faster.

Unrelatedly: I was very surprised that the GFW lets through Amazon web traffic.

how much bandwidth were you using?

Not much? Trying to post photos to Facebook/Flickr.

The GFW is apparently quite sophisticated[1] and likely uses machine learning among other things such as TLS side channel attacks.

[1] http://blog.zorinaq.com/my-experience-with-the-great-firewal...

I wish I could. I don't see how CHina could capture SSL traffic in terms of inspection, but my networking knowledge is limited.

Re: higher SSL latency, my best guess is either under-provisioned routing hardware or intentional throttling.

More generally, the network topology in mainland is a lot different than networks in other countries. There are 3 main ISPs that aren't as readily peered together as they are elsewhere. (From what I understand, if you were to run a hosting company inside China for example, you would want - or need - to have deals in place with each ISP).

Reply on news.ycombinator.com