Hacker News Reader

Comment by bayindirh | Hacker News Reader

> Lack of HTTPS on the author's site also adds a nice subtle flavour to the blogpost.

If you're not doing anything requiring security, you don't need HTTPS, IMHO.

> POP should really be considered legacy

I know people who knowingly use POP to keep their remote boxes empty, and keep everything local, so I don't think we should decide for people that swiftly.

Similarly, I'll let the wisdom of "Teh Internetz" to decide whether JMAP is worthy of the effort to replace IMAP. Having a IETF RFC is a good start, but let's see...

View on HN

> If you're not doing anything requiring security, you don't need HTTPS, IMHO.

I disagree, for a lot of reasons. For one thing, I don't want some random WI-FI to know every page I visit, even insecure pages.

I also don't want to leak any information about my browsing habits. Using https everywhere limits the information you leak about how much of your traffic is sensitive.

Unless you use DNS over HTTPS, all the effort there is moot. Even then, a flow server can trace all the point to point IP traffic passing over it. Yes, it limits the obtained data a lot (no hostnames to begin with), but a proper traffic analyzer is rarely blinded completely by HTTPS.

They would know the IP address and host name from SNI, but they wouldn't know which articles on the blog I read.

And if you're using TLS ECH, then they wouldn't even know the host name.

The website operator has to use it, too. Many HTTP servers still do not support TLS1.3 let alone ECH (Draft 13). ECH is still experimental. Cloudflare disabled their ESNI trial a while back (ESNI worked great for me outside the browser), so unless they have now got ECH working (I still have not seen any announcement), currently there are even fewer sites offering encrypted SNI. You could probably count them on one hand. And Firefox (nightly), Chromium (105+) and Brave (nightly) are probably the only browsers that would support ECH and it is not enabled by default. I would be pleased to learn I am wrong here, because I would love to again start using sites that do not return requested pages unless a servername is sent.

Comcast injects data into plain http pages, altering them when they see fit (they put in a datacap warning into the text of the page).

If Comcast is doing something wrong, why does everyone else need to do something about it? If Comcast stops routing packets on port 433, should everyone else stop using it as well?

ISPs are evil and untrusted. That’s just a fact. The solution is to not allow them to see or modify anything.

Other IT corporations are also evil and untrusted.

But no one cares if they can look into all your mails and documents (Microsoft, Google), track you all over the web, see where you are going, which flight you are taking,...

The important is that ISPs are evil and untrusted. facepalm

ISPs are the most blatantly scummy of the lot. They log everything, usually by government requirements, sell it to anyone, give it to the government without a warrant, inject adverts and js in to unprotected requests, and all kinds of malicious things.

They are easily eliminated from the picture. One less party with access to your data the better. There is really _no_ good argument for not having HTTPS on any site unless its some very rare case like an intranet site.

> But no one cares if they can look into all your mails and documents (Microsoft, Google), track you all over the web, see where you are going, which flight you are taking,...

I don't think I go a single day without reading posts complaining about exactly that, so obviously people do care.

Some places the ISP's are monopolies, or duopolies. Even with current tech giants you have many options.

This is like saying we shouldn't use encryption just because there are bad guys stealing our data... just because hackers do something wrong, why does everyone else need to do something about it?

We have to do a lot of things because bad guys do bad things. What is the alternative? Pretend they don't exist?

DoH is bad use DoT instead.

This couldn't be further from the truth. DoT is easy to block, so anyone who wants to censor or surveil you will just do so. You should always use DoH instead, since it's way more resistant to blocking.

Can't wait til google owns your DNS and you can't do shit about it

How does DoH make DNS any more centralized than DoT does?

When Google embed their DNS and their certificate into every Google product you have to use, you can't effectively block it.

If your goal isn't to censor or surveil other people, then why do you need to block Google's DNS rather than just not using it yourself?

Chromecast will use Google DNS and there is nothing you can do about it on the device. Guarantee this will happen to Chrome eventually.

Unfortunately, people are now often fighting with their own devices for control over which 3rd party services they access. This sometimes means that you have reasons to MITM or block traffic your own devices generate if you want to control aspects of who you actually send data to, or what data you actually send.

Not just block. I run split-horizon DNS at home for a few of my services. Without being able to control the DNS for devices on my LAN, they can't use those services.

Now you might argue that's a bit silly, but it is a use-case.

DNS over HTTPS is default on some browsers now. Firefox does it iirc.

HTTPs not completely blinding traffic analyzer doesn’t make the partial blinding useless.

Knowing that I'm watching YouTube is one thing, knowing what YouTube video I'm watching is a completely different problem.

Edit also: even with DNS over HTTPS, a lot of the Internet uses SNI for TLS, so anyone snooping can anyway see what hostname you're visiting (not to mention, IPs are not significantly more private than host names, and those will always be public unless you're using ToR or something similar).

> Unless you use DNS over HTTPS

It really isn't hard to set up an unbound resolver.

That's called a personal problem. It's not the responsibilty of a website owner to make his website constantly rot for the sake of strangers.

Don't use random Wi-Fi then? Or if you do, have an always on routed VPN?

You're leaking data all over the place, placing the burden on the website owner is silly.

> If you're not doing anything requiring security, you don't need HTTPS, IMHO.

There have been documented attacks of people getting hacked because they were browsing the web with plain-HTTP and someone injected malicious pages mid-stream; see "Quantum Insert":

* https://www.infoworld.com/article/2609621/uk-spy-agency-uses...

* https://www.wired.com/2015/04/researchers-uncover-method-det...

My ISP injects ads into http sites often.

Now just imagine what this corrupt third world government here can do.

Of course its "not a problem" if you aren't a vulnerable person who dares go against the grain, but on the whole it is.

If your site is not using tls then it's automatically blocked sorry, maybe I'm not your target audience regarding security blogs though :)

I think the more important question is why are you still supporting this ISP by being their customer?

could be on airport wifi, store wifi, cafe wifi, hotel wifi, etc...

https prevents them injecting shit

Sure, but this was in specific reference to “My ISP”. I can understand no choice in a hotel/cafe/etc. But there’s now lots of choice for home internet. Wired, cellular, even Starlink.

None of those are networks I could consider secure.

Even with https, there's no scenario where I'm not encapsulating all traffic in a tunnel there.

In corporate hellscapes like the USA, there is often no choice in ISPs, either because other ISPs can't justify the infrastructure investment to set up in opposition to the incumbent, or because the incumbent has lobbied local government to make use of power poles/conduits exclusive to them.

As if most people even have a choice.

If you're security focused, why not GRE tunnel to a vultr or similar VM and exit there? Then your ISP gets no information.

> If you're not doing anything requiring security, you don't need HTTPS, IMHO.

No, no, no, no, no, no, no.

ALL Web traffic should be https (or http/2 or /3). If you connect to a site that uses insecure http, ANY link between you and that site can easily snoop on traffic and even inject different content. You CANNOT be sure that the content you see is what was originally served by the server, and you can certainly expect that state actors will be noting that you viewed this content, and building a profile on you based on that information.

Hey, fellow genius on Hacker News, do note that TLS doesn't protect against state actors, because they can very easily manipulate certificate authorities, and a malicious certificate authority completely removes most protections TLS supposedly provides.

It could, if the CAs were globally distributed. Unfortunately currently they are all under the US influence.

It's enough to compromise one CA for TLS to be entirely defeated - any CA can sign a certificate for any site, and TLS implementations will accept it. The only defense is pinned certificates, but that comes with its own problems.

Certificate Transparency is enforced, so it'd be quite easy to detect that compromise by now.

Sure, but still somewhat after the fact.

Have you considered disabling non-https in your browser, and blocked outbound port 80 on your home router?

Firmly disagree.

Anyone can use any protocol they wish to, that's the beauty of the internet.

Expressing a public opinion on how communication systems should implement their authentication needs at least some security, IMHO.

> I know people who knowingly use POP to keep their remote boxes empty, and keep everything local, so I don't think we should decide for people that swiftly.

That could be done using IMAP as well. The overhead for that use case seems quite small. However it is just one protocol to support. And I haverun into a bunch of non-techy users with problems like "if i read my mails on my desktop I can't access them on my phone anymore, so I always use the phone"-like problems, which tells me their mail client on desktop likely uses POP3. By not offering POP3 you are removing that class of support problems with very little downside.

In what way can you configure IMAP to not leave messages on the server and yet still give multiple clients access to that email?

If you use POP (and allow it to delete downloaded messages from the server), you still can't access your mail from multiple clients.

Reply on news.ycombinator.com