Thepiratebay.se SSL certificate expired on 2/2/13 3:52 AM | Hacker News Reader

13 3:52 AM

thepiratebay.se

28 pointsmerah19 comments

People do understand that the certificate expiring does not affect security or encryption in any way, right? All it means is that some registrar wants to be paid now?

It does affect security.

1. User visits site. Gets warned about expired certificate. Tells browser to go ahead and ignore the error.

2. Later, user visits site again. This time, though, someone is doing a MITM or DNS hijack. User gets warning about certificate not matching domain. User thinks it is just the expired warning, and so tells the browser to ignore it.

"Secure" is a whole system property. The whole system includes the users and their expectations. An expired certificate changes user expectations.

unrelated, but how utterly ridiculous that thepiratebay.se is blocked for me (UK, Be broadband), when nothing else is, whatever the content.

Actually, any child porn sites that the Internet Watch Foundation notices will be blocked too.

The difference between the anti-piracy and illegal porn blocks are that the porn blocks are transparant whilst the anti-piracy blocks are a clear notification page. I'm not sure if that was due to a requirement in the judgement or something else.

I just get a page that never loads for piratebay.se. Far from a clear notification. Then again, I don't use my ISP's DNS.

What does this actually mean? To me, the obvious part is that people in coffee shops could be targeted. Is the most dangerous part about it to do with ISPs? They already could know what pages you visit TPB anyway, couldn't they? In Fiddler today all I seemed to see were handshakes to a secure site I host, but I couldn't see what pages or assets were requested. Do ISPs have the same problem?

Unless ISPs can magically decrypt HTTP requests, all they can see are sending & receiving IP and port. Without SSL, ISPs can view everything (unless tunneling or something similar to add encryption to an unencrypted protocol).

I think you meant `Unless ISPs can magically decrypt HTTPS requests`.

exactly my question, since I'm not the security expert either. I'm wondering, why there was no announcement about it, if it did happen few days ago (or today)

Could it be that they have something local now ? Not many SSL providers would side with them is evident.

How is this interesting?

It looks like the certificate has been replaced, but not yet on static.thepiratebay.se.

Their wildcard certificate appears updated. Valid from "2/1/13 Feb 1,9:47:57 GMT" until "3/5/15 Mar 5,10:48:42 GMT".

It has been renewed until 2015.. :)

hmm, its not my imagination, but I did got that message some days ago as well, since it went away after few hours, I thought it was just something, not that big.

are they going to renew it?

I don't see why not? TPB is already low-hanging fruit so any extra HTTPS encryption will go a long way for security purposes.

You spelt it wrong.

tak ;)

Reply on news.ycombinator.com