Hacker News Reader

Comment by lol768 | Hacker News Reader

> It is available over HTTPS, and we have plans to redirect insecure traffic to HTTPS in the not-so-distant future.

    ~ curl -I https://www.bbc.co.uk/news/0
  HTTP/1.1 301 Moved Permanently
  Content-Type: text/html
  Date: Mon, 24 Apr 2017 09:33:49 GMT
  Location: http://www.bbc.co.uk/news/0
  Connection: Keep-Alive
  Content-Length: 0

What annoys me most about this is that there is a valid GlobalSign SSL certificate there and the server can clearly handle TLS handshakes. It's just deliberately being used to make the user's experience less secure.

I realise this is being worked on and somewhat tangenital to this post, but the BBC's rollout of HTTPS has been shockingly poor and incredibly slow comapred to other news organisations. What's the point of serving account.bbc.co.uk securely if all links to sign in can be MitM'd? The parts that can be accessed with HTTPS don't seem to use HSTS either.

View on HN

Hi, BBC employee here (although not in News). Basically, we're working on it. The main issue is that by making a page HTTPS only, that all content also needs to be HTTPS too. We're working with our CDN providers to enable that (not only for new content, but for our archive too), and we also have to support a much longer tail of browsers and SSL configurations than other sites (China being an important market for us, and anecdotally I've heard we still get >1% IE7 from China, presumably from pirated XP machines) which makes it more complicated. It's not really an excuse, but there are people working very hard at enabling TLS without breaking the site for others. Other parts of the BBC website are available over HTTPS, hence the redirects that are in place. Similarly, we can't use HSTS as that applies to the whole domain.

> Similarly, we can't use HSTS as that applies to the whole domain

Is this a problem for e.g. account.bbc.com though? I can't see how that can impact bbc.com/bbc.co.uk if the header is set on the subdomain only.

I remember it used to be that e.g. news was accessed via news.bbc.co.uk but this seems to have been changed more recently to be accessible at /news. As you note, this makes HSTS a no-go because of all the other products on the same domain need to support HTTPS. This makes me wonder why this change was made in the first place. It would also seemingly mean that (without e.g. https://w3c.github.io/webappsec-suborigins/) an XSS in one product means an XSS everywhere.

I'm sympathetic re. the SSL configurations you need to deal with and it's reassuring that this is being worked on.

Ah true, I'm not close enough with the detail of some of the subdomains to know what's going on there.

A few years ago a decision was made that the BBC site should be all under www.bbc.co.uk, I believe this was mostly for marketing purposes, but also to simplify our internal routing for the site. news.bbc.co.uk was previously separate as News had it's own infrastructure separate from other parts of the BBC, but that's been rationalised now (leaking subdomains for technical reasons was something we frown upon).

You're right, it's not a problem for account.bbc.com, which off the back off your parent comment I've raised pull requests to get HSTS added. To answer why that subdomain exists: firstly cookie compartmentalisation allows us to set particularly sensitive cookies off to a separate domain, as well as allowing us to do different arrangements for traffic management separate from www.

Slightly off topic, but can you please allow fallback when there is no Flash. The player works, but you have to hack you user-agent string to get it. I don't have Flash in Firefox and the BBC news is only site, that I visit regularly, for which this is an issue.

This is again something we're working on, a lot of it matters which video you're trying to watch. Because of reasons* some videos get transcoded into codecs that don't play in all browsers, hence Flash by default on News. In the mean time, you can opt in to the HTML5 by default trial: http://www.bbc.co.uk/html5

I think you'll find that the vast majority of old browsers coming from China are in fact robots/spiders hard-coded with MSIE user agent strings.

HSTS is not something you can realistically implement until every path under the domain can be served via HTTPS. For the BBC this is problematic because there are hundreds of products and inter-dependencies under the bbc.co.uk/bbc.com endpoints. The amount of work required to do this is non-trivial, and not something that can be done in blanket - each product needs to test their product, its dependencies etc. There's also other issues like CDN endpoints (and the BBC uses several providers, including its own CDN), a relatively large and complex traffic management set up and the politics that comes with a relatively large organisation running a very big website.

Reply on news.ycombinator.com