Hacker News Reader

Comment by tambre | Hacker News Reader

Fortunately we're being uncrippled again by the continued deployment of IPv6 [0].

[0]: https://www.google.com/intl/en/ipv6/statistics.html

Germany (44%) and Belgium (53%) are killing it! The biggest surprise is India matching the US, must be that Indian mobile company that people mentioned here the other day?

I'd love to see similar graphs for TLS.

Edit: Google shows it only for Chromium sampling but it's nearly 90% in most countries which is almost double what it was before the Snowden leaks: https://transparencyreport.google.com/https/overview

Yes! It's the same company. There network was ipv6 ready since day one.

Honestly I think the adoption of TLS has more to do with free certificates from LetsEncrypt and CloudFlare than the Snowden leaks.

As much as I'd like to think people were concerned about the privacy of their communications... I don't think most of the masses actually care about security or avoid conveniences based on threats to their privacy...

“The masses” don’t deploy http servers. They don’t need to implement tls. The fact is that something struck a nerve and motivated the people who handle this to implement TLS. Whether that’s tech-minded understanding or consumer-fomented demand channeled through CTOs, I don’t really care. Let’s Encrypt founders didn’t sit down one day with a master business plan of getting rich off free certs. I wouldn’t be the least bit surprised if a high-level view showed Snowden having a lot to do with it.

LetsEncrypt was likely accelerated by the Snowden leaks, but the discussions around free community run CAs were around long before that precipitous event. For CloudFlare it was likely just an effective way to drive additional business to them while pursuing their business model.

I don't think "the masses" fall into the equation at all and likely haven't even really noticed the change besides the "This site isn't safe" warnings that occasionally pop up.

If LetsEncrypt was accelerated by the Snowden leaks, that's a rather sad result. After all, it is absolutely trivial for a nation-state actor to generate SSL certificates for any domain they like, due to the broken state of global PKI. It is sufficient to gain access to any root certificate, or to know a person at a CA that can issue certificates, or to be able to manipulate the domain's nameserver, or to take over the server pointed to by the domain's A record, or to redirect traffic to that server to a middleman at the ISP level, in order to issue a perfectly valid, HSTS-accepted certificate.

SSL helps against the skript kiddie at your local Starbucks, not against the NSA.

(Of course, not being able to monitor and log all web traffic all the time must be a slight inconvenience, especially after the TLS 1.3 SAN changes. But we still shouldn't fool ourselves that just because we can't break it, the NSA can't either.)

>It is sufficient to gain access to any root certificate, or to know a person at a CA that can issue certificates, or to be able to manipulate the domain's nameserver, or to take over the server pointed to by the domain's A record, or to redirect traffic to that server to a middleman at the ISP level, in order to issue a perfectly valid, HSTS-accepted certificate.

But every connection you're intercepting, you're providing airtight evidence that a misissuance occured (the certificate). It's only a matter of time until you're caught. With certificate transparency, it's broadcast to everyone in the world.

So yes, nation states can bypass pki pretty easily, but it's only feasible for targeted attacks. That's better than the status quo of dragnet surveillance.

> “The masses” don’t deploy HTTP servers.

In a way they do...

Every UPnP device is also a HTTP server (listening for SOAP requests), as are many other IoT devices.

I have two light bulbs in my room that are both running HTTP servers.

“The masses” are definitely deploying this type of HTTP server frequently

> The fact is that something struck a nerve and motivated the people who handle this to implement TLS

for the dot coms, let's not forget about Google's rank incentive.

https://thenextweb.com/google/2015/12/17/unsecured-websites-...

Regardless of why that’s still 40-50% less of the raw internet traffic intel agencies can get warrantlessly from ISP network tapping rooms and undersea cables splices.

Not to mention their lost access to private Google (and probably Yahoo, Microsoft, etc) networks and a myriad of other security improvements across countless software platforms.

Still a long way to go.

Reply on news.ycombinator.com