Hacker News Reader

Comment by IgorPartola | Hacker News Reader

This is so frustrating. So many sites are still accessible over HTTP. Perhaps some of the security tools out there (a la ssllabs.com) should start giving you a warning, etc. for serving anything but a 301 over HTTP.

Also, really, Apple can't figure out how to get a wildcard cert and properly install it? I had an idea at one point to put together an bot to scan and publicly shame Alexa top whatever sites if they don't do HTTPS properly and consistently. Perhaps I should go back to that idea.

View on HN

Extended validation certificates[1] (the fancy ones with the green URL bar) aren't allowed to contain wildcard entries.

1: http://en.wikipedia.org/wiki/Extended_Validation_Certificate

Then don't use EV? EV certs are generally pretty dubious, but I imagine the distinction between self-signed or no cert vs non-EV valid cert is pretty big.

Browser makers are starting to really de-emphasize domain validated certs in favor of EV. In many cases now, non EV certs don't trigger anything to be green in the browser address bar:

Screenshots: https://www.expeditedssl.com/pages/visual-security-browser-s...

Why do all sites need to be HTTPS?

The typical argument is if only sensitive traffic is encrypted, you know that something is worth attacking because it is encrypted.

Ergo, encrypt everything, and the sensitive stuff can hide in a sea of meaningless traffic.

There not much I really need to have encrypted, my bank website, my emails, my files on cloud services and my ssh sessions.

Anyone that can do a MITM over HTTPS can really easily find the hostname of all theses IP. in fact anyone could find the hostname of theses IP....

And every password and login form you use to protect your passwords. And every government form you fill out (they often require personal identifying info). And every link that links to those forms, etc. There are a lot more ways to attack a connection than just hijacking a cleartext bank password.

That's why I double and triple check the URL on important service before I fill out everything.

If you only encrypt your most important secrets, they are far more vulnerable to attack. Sometimes what you hide can be inferred by what you don't, etc..

I hear you, though, it's a real pain, but welcome to 2014, we're all learning more about crypto than we ever thought we would have to know, which is what crypto experts have been telling us for 20+ years we would have to do.

Unencrypted channels can be spied on to see which pages you're looking at, or hijacked to serve malware. Note that even with HTTPS, a passive sniffer can tell which domains you're visiting.

They don't. And shouldn't be,

What justizin said. Also, let's say that I am able to MitM your connection to apple.com. You are a brand new customer, credit card in hand, ready to buy yourself a brand new $5,000 Mac Pro, and a couple of Cinema displays. You open up Chrome, go to apple.com, but instead of getting the real deal, you get my slightly modified version. The change? I run a regex on all the HTML served (that's right, I'm a real h@x0r, and regex my HTML like a boss) that does s/store\.apple\.com/apple-store.com/g. Now, apple-store.com has its own valid SSL cert, so you get the nice green bar when you get to https://apple-store.com. This site is mine, and all it does is serve the content from the legitimate store.apple.com, except it also injects a small script into the payment form. As soon as you type in your credit card info, it is mine. Moreover, I know exactly how much you spent, and maybe I even allow you to place the order, get all the confirmations, etc. You won't know that something went wrong until I sell your CC number on the black market and some guy in Uzbekistan buys himself an iPhone 6 Plus with your money.

Edit: apple-store.com is obviously a real site, so let's say I find something just as legitimately looking as that.

Even a blog should be served over HTTPs. There's opportunity to inject JS for a MITM attack. Greyhound wifi does this all the time.

Something more interesting: if your site provides something like a code snippet, a MITM could change it.

A lot of download sites serve downloads on http. A MITM could change out the binary. This is especially bad if you're downloading something like a library (example: zeptojs, foundation by zurb)

So yeah. There's a lot of attack vectors. Do your best to minimize it even if you can't think of anything.

Reply on news.ycombinator.com