Hacker News Reader

Comment by superkuh | Hacker News Reader

The greater mistake isn't being perpetrated by the big browser companies scaremongering bad certs. The fault lies with every sysadmin or web dev that choses to 301 redirect from HTTP to HTTPS and not have HTTP+HTTPS. You can do your part to make this a non-problem by always serving HTTP and HTTPS both.

View on HN

And i guess you think TLS-stripping attacks are unimportant?

For many sites, and probably most non-commercial sites, yes. Anyone thinking about this issue can decide if that threat model applies to them: do they even have a log in, or is it just html files and jpegs in directories? etc.

How do you determine a users privacy requirements by site alone? The content does not imply relevance to privacy abuse; abusers come in all manners and may take abusive objection to content like w3.org that would to most people seem innocuous.

It's pretty easy when you are the person that made the website (like most personal websites).

Again, I am not advocating for not having HTTPS so I don't know why you think HTTP+HTTPS is less private. It is exactly as private only it is also human readable and requires no centralized authority's lease to be visitable.

Well that depends on what the jpegs and html files contain.

For example, the fact you are reading the wikipedia article on Tiananmen square incident might be very sensitive if you live in China (ignoring the part where they block wikipedia). Other places might object to various other speech, etc.

Although to be fair, the mass survelience threat model is probably less likely to have an active attack like tls stripping. But annonoyminity is all about hiding in the crowd; only securing the connection when you have something to hide from eavesdroppers means that you have no crowd to hide in when you need to.

Do you know how I can set allow http connections to my website (on Github pages with a custom domain), while ensuring that anyone who types "example.com" without a protocol gets the https version by default? I wanted to set up my website that way, but I couldn't figure out a way to do it, since many browsers still default to http.

In many cases this isn't the behavior you as the consumer would want. For an example, if your bank's certificate expires it's not ideal for the end user to be unwittingly redirected to http, and inadvertently access their account over an unencrypted connection.

What's HTTP+HTTPS?

Serve the same content over HTTP and HTTPS. Many web admins today don’t serve content over http, instead they HTTP/301 redirect all http requests to https.

Reply on news.ycombinator.com