United States wants HTTPS for all government sites, all the time
nakedsecurity.sophos.com
nakedsecurity.sophos.com
It's free and easy to setup for your own country if you're interested: https://websecuritymap.org/
Example of the site running for the Netherlands: https://basisbeveiliging.nl/
I understand the risks but am curious if there have been some cases that are pushing https forward after they got publicity.
PS. The .org site does not look well on FF/Android (texts clipped, etc.)
Here's my take: the title is unclear. The federal government has required https for a while.
Learn more here: https://https.cio.gov/
OMB wrote a memo requiring https in 2015: https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/me...
If you see the "announcement" linked in the article, you'll notice that it's referencing this page: https://home.dotgov.gov/, which is about the HSTS preload list.
Non-tech being very important here. The US government is not a technology company. So think of the worst enterprise software you've seen and the US government has it beat somewhere on some system they are still using.
How does this happen? Contracts, they write contracts to the lowest bidder to build them software and then they pick the greenest/cheapest software engineers to do work in a mix of waterfall, agile, what's older than waterfall?
On top of that they've got mission critical software that runs on this stuff. A silly little change like upgrading paper Notices to Airmen (NOTAMs) requires YEARS of planning, safety analysis, and buy in from a representative every airport/airline/airtraffic controller across the US. Multiple unions etc.
At it's worst the us government is slower than the slowest enterprise company you've seen.
On top of all that, there is a review board for EVERY (mostly open source library you want to import, so there aren't bad actors on it. This review process is slow and pushes back on innovation. The worst thing you can do as a contractor is not hit your deadline. So many of them use tried and true technologies to get the job done, but don't innovate.
Is it by decision? Yes the decision to pick the cheapest contractors, yes by the decision to include security in a way that actually slows things down, yes by a myriad of decisions that make innovating government software really hard.
Is it by incompetence? Meh, yes and no. You have people even at these contracts who are railing and screaming against this. There is competence in all these places. But the pressure to slow down and do things a specific way push back so hard it's really difficult to accept new risk.
And this was just my experience on one contract. Another government contract was super innovative and fun.
Also the innovative nature of what we were building at the new contract vs. just redoing a crud app.
I suspect part of it was me too. My first job, vs my ability to discern better contracts etc in for future ones.
The switch from HTTP to HTTPS is almost never as simple as "call LetsEncrypt and switch the port number". If you have an existing HTTP site that includes Images, Script, Styles, Frames from other HTTP resources, switching the top of the page to HTTPS may break functionality on the page if the browser's security settings deny HTTP resources from being loaded on the newly HTTPS page.
That said, there's really no reason any government shouldn't prioritize these fixes... except we are in the middle of a COVID-pocalypse where budgets are likely to get slashed. Sometimes it's "incompetence" of management (not seeing the risk after it's described to them or their underlings not communicating the risk), but mostly
I know its a bit of a nitpick, but its important that they know we understand the laws they want to push through and STILL disagree with them.
I take it you've never worked for the government, have you?
Heads should roll, really.
You can read more about this here: http://n-gate.com/software/2017/ (Discourse on https)
Such a pointless read.
Make a valid argument and I'll listen to you, but parroting "but I don't need it" does nothing to add to the conversation at all.
Is adding HTTPS a 100% required critical sev0 ship-blocking bug on every site in the world? No. Is it a valuable improvement to add HTTPS? I'd argue that it is.
It really is amazing to see how often one part of the government will actively sabotage the goals of other agencies.
The only problem I have run into with various government orgs is the lack of knowledge around implementing intermediate certificates. They will often try to talk people into installing their certs rather than installing intermediate certs correctly. I always point them to testssl.sh [1]
> I don't believe they are making encryption illegal....They want the ability to access data from the servers after it has been decrypted. This includes a way to intercept what users perceive to be end-to-end encryption.
This is contradictory, no? The data is not encrypted between 2 users if a 3rd user can read it. It sounds like every bill you read makes encryption illegal, by your own explanation of the bill? I just don't understand what you mean here.
Maybe it's my personal understanding of 'encryption'? If Alice encrypts a message to Bob, and also gives the keys to Eve, but doesn't tell Bob that Eve has the keys, then I do not personally consider that message encrypted at all. Do you? What about the bills?
A message encrypted with a key held by a potential attacker is not an encrypted message any more.
And for plenty of people who don't have the lawful intercept access. This downgrades encryption from "encrypts stuff" to "obfuscates stuff"; while technically incorrect, it's probably better to describe this as "no longer encryption" because it's clearer to non-techies.
I believe the right way to describe this to non technical people would be: "Today, some people can see your traffic even if it is encrypted. If one of these bills (there are a few versions) are approved, then more groups will be able to see your data, easier and quicker."
If you want to get people more interested in speaking up, then the best lessons learned would be from the interview between John Oliver and Edward Snowden. John interviewed many people on the street about the NSA having access to all your phone data. Nobody cared until he clarified and said, "So you would be ok with government employees looking at your significant others nude pics / sexting pics". At that point, most of the people interviewed said they would be furious.
[1] https://www.congress.gov/bill/116th-congress/senate-bill/339...
"(3) MATTERS ADDRESSED.—The matters addressed by the recommended best practices developed and submitted by the Commission under paragraph (1) shall include—
(A) preventing, identifying, disrupting, and reporting child sexual exploitation;
(B) coordinating with non-profit organizations and other providers of interactive computer services to preserve, remove from view, and report child sexual exploitation;
(C) retaining child sexual exploitation content and related user identification and location data;
(D) receiving and triaging reports of child sexual exploitation by users of interactive computer services, including self-reporting;
(E) implementing a standard rating and categorization system to identify the type and severity of child sexual abuse material;
(F) training and supporting content moderators who review child sexual exploitation content for the purposes of preventing and disrupting online child sexual exploitation;
(G) preparing and issuing transparency reports, including disclosures in terms of service, relating to identifying, categorizing, and reporting child sexual exploitation and efforts to prevent and disrupt online child sexual exploitation;
(H) coordinating with voluntary initiatives offered among and to providers of interactive computer services relating to identifying, categorizing, and reporting child sexual exploitation;
(I) employing age rating and age gating systems to reduce child sexual exploitation;
(J) offering parental control products that enable customers to limit the types of websites, social media platforms, and internet content that are accessible to children; and
(K) contractual and operational practices to ensure third parties, contractors, and affiliates comply with the best practices."
> We’ve explained how the EARN IT Act could be used to drastically undermine encryption. Although the bill doesn’t use the word “encryption” in its text, it gives government officials like Attorney General William Barr the power to compel online service providers to break encryption or be exposed to potentially crushing legal liability.
> The bill also violates the Constitution’s protections for free speech and privacy. As Congress considers the EARN IT Act—which would require online platforms to comply with to-be-determined “best practices” in order to preserve certain protections from criminal and civil liability for user-generated content under Section 230 (47 U.S.C. § 230)—it’s important to highlight the bill’s First and Fourth Amendment problems.
[1] https://www.eff.org/deeplinks/2020/03/earn-it-act-violates-c...
That doesn't mean that is what's going to happen. The potential actions to be taken would still take in recommendations from provider input as stated in the bill. All the chatter online seems to speak definitively as if is the latter.
Using vague wording in legislation is a "bad code smell". Giving the authority to the DoJ (who is both a partisan, nominated official, and is very biased in the prosecution of those whoa re accused of breaking this law. I don't put any credence in "still take in recommendations from provider input"; I assume Congress and the DoJ can ignore any and all feedback if they choose to make a partisan show of a specific case/issue (and they have when it comes to encryption unlocking phones of terrorists, child sexual abusers, and drug dealers).
The USA Feds seem to be on a similar plan, but it's more like a 10 year lag, and it finally seems to them like this HTTPS thing isn't just a fad.
Funnily enough the official website for the Holy See is also not HTTPS encrypted. (http://www.vatican.va)
So that turns out to be a funny misconfiguration. https://www.vatican.va/content/vatican/en.html works perfectly fine, but https://www.vatican.va redirects to http://www.vatican.va/content/vatican/it.html.
However, it's all fighting the insane bureaucratic system that requires mountains of paperwork to do anything, as well as requirements to contract out jobs to expensive and shitty contractors.
Can you go into specifics of the "wonky certificate settings"? I can probably help you out with that or at least bring it to the attention of the team here at VA.
Most federal agencies have their own internal PKI systems, and DoD is probably more unique than others because the infrastructure is bigger, older, and has different regulations governing them.
Most civilian agencies such as VA aside from DoD - should utilize public PKI / public CA for their certificates.
I can't speak for all government agencies, but generally there is an internal CA for hosting internal sites. I remember reading a comment from the Federal PKI guide that these sorts of infrastructure goes back to before 2004.
"Prior to 2004, some agencies had already deployed and invested in their own PKI and CAs. Some of these agencies opted out of migrating to the SSP Program and continued to manage their existing infrastructures. These Federal Agencies Legacy operate one or more CAs that are cross-certified with a Federal PKI Trust Infrastructure CA." - https://fpki.idmanagement.gov/ca/
Here's a very short list of public CA certificates from Treasury and it lists out public key certificate for many other agencies as well. - https://pki.treas.gov/crl_certs.htm
the governments we have are already wanting to surveil us plenty, we don't need a shadow entity doing it too.
in others, for them to procure from product companies rather than data companies.
I find this doubtful.
> ... and simultaneously reduced government expenses.
I find this almost tautologically impossible. By and large the government (my corner of it anyway) doesn't pay extra for licenses to commercial software. The idea that we could somehow find and hire enough developers to rewrite the entire Microsoft ecosystem, and somehow do it for less than it costs us to pay for Office 365 every year, requires some serious justification.
No, but governments often do (under policies that have a built-in, explicit preference for COTS or MOTS solutions because [in terms of public rationale] they are presumed to be especially cost-effective) pay for commercial software that's not well adapted to the specialized circumstances of government agencies, which even when broadly similar to public actors are often significantly governed by unusual or even sui generis considerations applying only to government or to that particular government jurisdiction or even only to that particular agency of that particular government. And then pay extra (either in terms of custom modifications or business process adaptations to the poorly-aligned software) for the mismatch.
In some cases this has knock-on effects, because managing the government cost ends up with the government requiring (explicitly or practically because of the requirements of interfacing with the proprietary system) encouraging trading partners, including intergovernmental ones with the same kinds of business fit issues, to use COTS/MOTS solutions from the same vendor.
Things like Office 365 are not the main issue.
For example I work at a bank that does not sell software and yet the bank has thousands of software developers.
And to the extent you are talking about how government works (online or offline), they manage to choose some terrible vendors. You don't get to opt out of those offline vendors, so what's the point of complaining about just a few online ones?
no, i'm not. everything we do is intimately tied together with huge slatherings of trust, browsing included. it's how societies and civilizations fundamentally work.
however, some entities like google have proven themselves less trustworthy. so let's move up the vendor ladder of trustworthiness, rather than staying stuck at the bottom.
> "...so what's the point of complaining about just a few online ones?"
with that kind of defeatism, what's the point of anything?
every improvement helps, particularly when it involves one of the, if not the, largest privacy-invading, data harvesting machines on the planet.
I would say that maybe there's a role for the Federal government to play in providing data hosting for smaller governments who can't afford to do it themselves, but with the general distrust of the Feds these days, I bet most here (including me, frankly) would rather give their data to MS and Google.
but yes, fed-gov providing smaller govs enterprise services seems like a potentially good and more efficient use of tax dollars, though concentrating surveillance is a concern.
But they want to backdoor the encryption so that foreign governments can spy on those encrypted connections. Genius.
The NSA tends to ignore the domestic quibbles about encryption because they tend to have much more flexibility in how they work around encryption hurdles. The DOJ and local police departments scream bloody murder about encryption everytime there is one phone they can't access and a few congress Critters use that call as a political wedge issue.
Posted here: https://news.ycombinator.com/item?id=23609538
the level of push back against it is absolutely epic.
the .gov I work on has even been considering moving most services off of .gov to another tld (such as .us) in order to avoid having to comply...
long answer: there are a lot of reasons...
one is that our network is obscenely open and used in weird ways.
public ips handed out to all the things via dhcp. dynamic hostnames (generated from the dhcp request) on a subdomain of our .gov for all the things. similarly static ips and top level dns records on our .gov are passed out like candy.
the border is heavily firewalled, and all networks are heavily sniffed and monitored, but everyone has a public ip with a .gov hostname. the network users consist of thousands of academics and scientists who use the network in fun an interesting ways, frequently without tls.
changing this culture is likely way more difficult than making config changes on bind and dhcpd
I've slowly learned to stop asking, and just try to keep my sobbing down during calls
>Which is it
It's both, there's two separate groups advocating for two separate things here.