Hacker News Reader

Comment by papsosouid | Hacker News Reader

I'm interested to know what everyone's take on the "use https always for everything" stance is. Does any site actually follow that rule? Even big names like facebook allow you to use http don't they? And what about the "don't put http elements in an https page"? Why not? What benefit is sending the images over https (thus making the page load slower) if they are on a seperate subdomain, so there's no cookies being sent with those requests?

View on HN

Re: images over HTTPS; most of the attacks involve an active MITM, so it's a question of how seriously you take that threat. Usually, most people ignore this scenario until it gets automated via "coffee shop network attack tools" like firesheep or sslstrip.

As a practical matter, if you embed http images in your HTTPs page I believe you will get mixed content warnings in some browsers. See e.g: http://stackoverflow.com/questions/3278341/help-with-ssl-vul...

Another strike against non HTTPs images is that if you don't have the 'secure' flag set on your cookies, these may get sent with requests, compromising your users' sessions. I guess you could consider not setting this cookie flag as a separate issue. Note that this is a passive threat, exploitable via sniffing.

Thirdly, an active MITM can return any MIME type in response to your <img src> link; you now have to be 100% sure that no browsers will try to process a malicious response of any type when it gets one instead of an image. Probably OK, but are you absolutely 100% sure? What about indefinitely, as browsers implement new features?

Fourthly, think about all the creative ways a malicious user could embed instructions or change the appearance of your site by substituting arbitrary image content. Also note that SVGs can run javascript. One could change an image to be an ad or promotion, for example, to convince the user to carry out an action.

I wouldn't neccesarily follow facebook's lead on security practices.

Modern thinking is that if you care about SSL at all, you should force SSL for everything. For example if your "secure banking site" has an HTTP landing page, an active MITM will just sslstrip the customers and get them to enter their password in the wrong box.

This is why we have HSTS (HTTP Strict Transport Security) header, and why sites that care deeply about security (gmail, paypal, lastpass, etc) use it. (See http://www.chromium.org/sts).

>(thus making the page load slower)

The difference is tiny. If your images are on the same domain as the html, you'll have no extra overhead from the ssl handshake (thanks to http keepalive), and the symmetric encryption used in an existing ssl connection will have a negligible impact on performance.

I can think of two reasons you want https, even for just images:

1) Even though modifying an image in flight will probably not have major security implications, you can't be sure. Perhaps a carefully edited and resized image could alter the layout of a form, tricking the careless user into publishing information they didn't mean to.

2) Perhaps your adversary is just a teenager bothering people trying to be productive at a coffee shop. Including a 10000x10000 image that makes the page unusable, or replacing your logo with porn isn't exactly something you want, even if it doesn't compromise anybody's bank account.

HTTP keepalives just means you only need to negotiate two extra SSL connections instead of n (n being the number of images in the page). The overhead of that is certainly noticeable. If there's no actual benefit, then it shouldn't be in his list of "stuff you have to do (and nobody actually does)".

But for most websites, it is something you have to do. Ruining the layout of your page is about as bad as any other DoS attack for most of the afflicted users.

GMail is a good example of HTTPS everywhere.

When you embed HTTP elements you can no longer trust their authenticity. If, for example, you load JS into your banking app over HTTP it would be possible for a man in the middle attack to substitute it with a script which could re-write the page or siphon off sensitive data.

HTTPS says "We can verify the site you're connecting to and all data transited between it and yourself is encrypted". Embedded HTTP content invalidates that premise.

I know what HTTPS is, I am asking why it matters in this specific context. We're not talking about javascript, we're talking about images. Nobody cares if the images are being sent securely, do they? From a random sampling, it sure doesn't look like very many https sites serve up https images. My current plan for our upcoming site launch is also to serve up images over http, not https. Is there an actual reason not to do this, or is it just "its on my list so do it"?

Any idea why so many sites allow http after logging in? I realize a facebook account isn't a high value target, but it seems crazy that a site that size works over http. I imagine they must have some reason to support http (not implying it has to be a good reason).

Well actually, we are talking about JavaScript, 5 separate .js files actually.

The challenge comes back to the fact that "Secure" in an HTTPS context is an absolute; either everything is loaded over HTTPS and you get a shiny padlock or it's not and you get a red cross (depending on the browser, of course). The browser itself obviously cannot discern what the developer feels should be loaded over a secure channel and what should not nor is there anything in the HTML/HTTP spec to support this (other than HSTS to force HTTPS).

The simple reason not to serve up HTTP content on an HTTPS page is that rightly or wrongly, the browser will tell your users that your site can't be trusted. I understand your point, but that's the implementation you'll find in the browsers of today.

Facebook is definitely a high value target, just ask a Tunisian who was using it early last year: http://www.thetechherald.com/articles/Tunisian-government-ha...

Not having HTTPS everywhere by default (although at least it's now a configurable option) is extremely serious for a site like Facebook. The fallout from governments monitoring political dissidents is just one example, the potential harvesting of personal information (including connections) is another that's closer to home. Remember Firesheep? http://en.wikipedia.org/wiki/Firesheep

Why doesn't Facebook force it everywhere? Perception of processing overhead (although debunked by Google), integration impact with non-HTTPS content (impact on ads has long been claimed as a barrier), re-engineering of one of the world's largest sites, etc. But it's heading in the right direction, Twitter, Facebook and Hotmail, for example have all made positive steps forward, I'm sure we'll see a much greater prevalence of HTTPS as time progresses.

Reply on news.ycombinator.com