Hacker News Reader

Comment by andrewstuart2 | Hacker News Reader

I think the best time to do this would be soon after the Let's Encrpyt free CA [1] starts handing out certificates. There's no more good reason not to have HTTPS, so that's a good time to start applying a little pressure and adding the incentive for website authors.

Does google already reward secure sites with higher search rankings? I can't decide if I think that's a good idea or not, but if they want to push for a more secure and free web, that's definitely another avenue.

[1] https://www.eff.org/press/releases/new-free-certificate-auth...

View on HN

There is a very good reason to not secure your site if you are dependent on ad revenue. When I switched to https, my earnings dropped by about half. I tried it for a week, but I couldn't take the losses.

When you have a secure site that uses Adsense, Google only serves ads from secure ad servers. This shrinks the pool of competing bidders significantly.

For me to switch back, either Google needs to push advertising networks into securing their ad servers, or the nonsecure warning will have to be really big and scary.

I recently switched my (small and ad-free) blog to https-only and I saw a sharp drop in traffic. I highly suspect that is due to various malicious robots and crawlers not handling either https or redirects from http to https correctly. For instance, attempted comment spam fell to almost zero after the switch.

Considering that at least part of the ad clicks comes from robots (there was a recent post about that on HN), it might be that some of your lost revenue was due to that effect.

According to my CloudFlare analytics for the last 30 days (I draw on them because they try to measure bots):

2,230,909 Page views 2,094,927 regular traffic 126,337 crawlers/bots 9,645 threats

While there certainly are a lot of automated visits, they are still a fraction of what appears to be legitimate traffic. Furthermore, I'm pretty sure that CloudFlare blocks or challenges (edit: malicious) bot traffic, so I doubt that is the spoon that is stirring the pot.

I am not alone in reporting this: https://www.seroundtable.com/https-google-adsense-19035.html

It is a serious issue, one which I'm sure is hindering https adoption around the web.

I also switched my small and ad-free blog to https-only and I haven't noticed a drop in traffic. On the other hand, even if I had, I wouldn't have cared.

I'm proud to contribute to a saner Internet and it does matter even for small blogs because I noticed networks that inject content in websites - I don't know how this practice evolved in the US, but a couple of years ago while traveling there the Wifi networks in the 2 motels I stayed at were injecting ads in the websites I was visiting. I found that to be extremely distasteful.

For me HTTPS is a way of signing my content. Shameless plug - https://www.bionicspirit.com/ :-)

This is a really interesting observation. Can you expand upon what "shrinks the pool of competing bidders significantly" means? For instance, when creating an Ad Words campaign, is there a setting/option that they must opt-in to and if they do not they won't be considered for secure-only advertising?

Here is relevant information about it taken from this page: https://support.google.com/adsense/answer/10528?hl=en

"HTTPS-enabled sites require that all content on the page, including the ads, be SSL-compliant. As such, AdSense will remove all non-SSL compliant ads from competing in the auction on these pages. If you do decide to convert your HTTP site to HTTPS, please be aware that because we remove non-SSL compliant ads from the auction, thereby reducing auction pressure, ads on your HTTPS pages might earn less than those on your HTTP pages."

To answer your question more directly: besides AdWords, Google manages the ad inventories of a dozen or so third-party ad networks. Lots of the display advertisements that appear on the web are served via these ad networks. Many of these connections are not encrypted and, as you probably know, if a single image on the page is not encrypted it jeopardizes the security of the connection. To maintain the integrity of the connection, the nonsecure networks are eliminated from the bidding process. Fewer bidders, lower final value.

> if a single image on the page is not encrypted it jeopardizes the security of the connection

But only in the sense that the article text could say e.g. "implement the authentication algorithm according to illustration #42" and illustration #42 could have been maliciously replaced with an image showing an incorrect implementation, right?

A script served over an insecure connection, on the other hand, would give the attacker access to the DOM and compromise the entire page (and other pages on the site with AJAX).

So does the fact that ads need to be served securely imply that they have the ability to execute JavaScript in the context of the page? By serving ads (whether encrypted or not) am I trusting every advertiser on the network with the session cookies of all my users, essentially allowing them to intercept communications between the site and its users?

I can't speak too much about this because it is on the fringes of my knowledge. All I can say is that I trust Google's systems to screen for malverstising. I remember there was an incident recently where one of the ad networks that they manage was serving malicious JavaScript, but they caught it pretty quickly and blocked that network from serving ads.

I do not believe that I can improve on their systems.

> if a single image on the page is not encrypted it jeopardizes the security of the connection

Or, you know, loading untrusted javascript onto your page could also jeopardize the security of your site.

I'm guessing it means that ads that lead to http:// urls get binned.

No, ads that originate from such urls get binned.

This is what's holding me back as well. I'm happy to put in whatever development effort is required to get everything on https, but many of our advertisers through various networks (including Google's) don't yet support it.

Have you sent them a request asking when they will support https? The more customers requesting, the more likely they will weight adding support. You could even request it under the cover of Google weighting https more.

> There's no more good reason not to have HTTPS

Cost. Today I host my website for 6 cents a month as a static page on Amazon S3.

To go https, I'd have to first acquire a certificate (lucky that can be free and with Let's Encrypt will be). Then I have to find someone to host that certificate. I can pay someone hundreds to thousands of dollars in setup and monthly fees.

Or, the cheapest option I've found is to get a $6/mo VPS as a frontend, put nginx on it, and put my cert there. The problem is that costs 100 times as much as what I pay now, and I have to maintain a server and it's not served from multiple redundant servers like my site is now.

Or I can use Amazon's free SNI support, making it so that older browsers can't see my site and I have no way of blocking people from using http or redirecting them.

There is currently no good, cheap option to do SSL only that is viewable by everyone.

That's why I haven't switched yet.

I understand the principle, but let's not get to philosophical about this: You ran reddit's servers and worked at netflix in their availability department. Cut out a morning coffee and you have enough money to run SSL.

SNI works with anyone on Windows > XP, and any mobile / Apple / Linux OS you'll find visiting your site. How many IE6/XP hits does your site get per month?

Even on Windows XP, it is only IExplorer that doesn't do SNI. Chrome or Firefox have no problem.

The bigger problem right now is Android 2.x. But the lifetime of phones is only about 2 years and the market-share of Android 2.x has dropped below 20%.

And it really depends on the audience. The market share of all IExplorer versions on my blog is less than 4%, out of which IExplorer 11 represents more than half of that.

> The bigger problem right now is Android 2.x. But the lifetime of phones is only about 2 years and the market-share of Android 2.x has dropped below 20%.

Below 10% even[1]. Agreed on device lifetime. Unlike PCs that can stick it out much longer, give it another year and it'll be well below IE6 levels. Can't come soon enough.

[1] https://developer.android.com/about/dashboards/index.html

The problem here is that increasing the difficulty or learning curve of a system is always unpopular.

If SSL was truley as trivial as a check box, then we would see very wide adoption.

>The problem is that costs 100 times as much as what I pay now

The "100 times as much" is not that impressive, if it merely goes from 6 cents to 6 dollars.

I suggest looking at the world beyond your immediate environs.

6 cents vs 6 dollars is the difference between a person in a low-income economy spending 0.1% vs 18% of their income on a website.

That works out to an income of about $33/mo. I think that person has a lot more to worry about than where to host their static site.

My source for that figure was the World Bank[1], which gives a GNI per capita of 400USD PA for the Democratic Republic of Congo.

[1]: http://data.worldbank.org/country/congo-dem-rep

Which in big chunks of the western world is not that much, but it will increase the barrier for entry for many in poorer nations. For commercial sites, then maybe I see a benefit. For everything else... why bother? The info isn't secret, doesn't need to be and since there's so much data going around already is anyone malicious bothering to look?

And what do you think that means for websites that are 100 times as big? They go from being rather cheap to host to being money drains.

We need better infrastructure.

Cloudflare provides a free ssl service.

A free MITM service, you mean.

With ECDSA only certificates, which are even less supported by old browsers than SNI.

NearlyFreeSpeech.net offers comparable value to S3, and you can use apache features like .htaccess for redirection. Only problem is that it's still SNI, if that's important for you.

Sounds like an opportunity for a startup if I've ever heard one.

Yeah, more nickel and diming.

> Does google already reward secure sites with higher search rankings?

Yes, although only recently and only slightly.

http://googlewebmastercentral.blogspot.com/2014/08/https-as-...

I still haven't heard a reason why it's important that my blog is on https. Waiting.

1) Sometimes it's not about you.

Currently, the NSA (and others, presumably) consider the presence of encryption as part of their is_suspicious() heuristic. Other people do have need for encryption, and by saying "I (currently) have nothing to hide", you are saying that you are fine with a high correlation between "uses encryption" and "is doing something suspicious". More than any other reason, we need to dilute that correlation until all data looks similar to remove the possibility of this kind of categorization.

2) https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html

As Zimmermann said, we need to socially normalize the use of envelopes instead of the postcards that are currently used. Without that social expectation, it will be possible to legislate against the use of encryption in the future.

3) It lets us (in the very long term) simply retire 80/tcp

...and plain HTTP servers in general. Sure, this is a minor benefit, but it would still be nice.

While those are all valid reasons they land on the "greater good" side of the scale, which doesn't have the obvious "what's in it for me" I think many people are looking for.

My thoughts

1. Not having secrets - MITM isn't necessarily conducted by malicious attackers, but that doesn't mean it's bad. Consider for example a company that wants to identify usage behavior and buys traffic data from an ISP. While the data may be anonymized it's still someone's usage. With https, a webmaster is limiting the info those companies can get so instead of being able to run a complete analysis on the type of text a user reads and images they see, over https they could only tell what websites you go to. It's still pretty bad, but not as bad.

2. Cost - I do see the value of cheap hosting on S3 and getting redundancy. I've been hosting servers from the days before AWS existed (I started young) and know one thing - if you can't afford something you probably don't need it.

Why does you $0.06 site need to have a multi node setup? I don't mean to sound like a jerk but if you had the kind of traffic a multi node + DSL site needs you'd probably have the funds to invest in it. It's really not very expensive considering a cup of Starbucks coffee costs 100 times what you currently pay for hosting...

If your content isn't secret why not go with a cheap SNI that can host your certificate and put that behind cloudflare (which is free)?

> "What's in it for me"

I'll ignore he obvious selfish nature of this question and simply point out that you may need to take advantage of that "culture of always encrypting everything at some point in the future. It is incredibly short-sighted to assume that you're not ever going to be a target.

> "not having secrets"

You can look the numerous rebuttals for this very well-known fallacy.

> Cost.

It's probably worth mentioning that I am currently living on SSDI (social security disability income) thanks to some unfortunate medical issues. I cannot actually afford any PKI cert and related costs, even $20 costs.

Well, the EFF may soon have a free solution for this, and almost all of the benefits I list are still valid even when the crypto is relying on an self-signed certificate automagically generated by apache on first use.

I would love to see more options that address the cost issue - secure communications should not be limited to those that can afford various economic barriers, but for now at least some solution exists.

What's wrong with StartSSL for your use?

You assume they are always available and always do business with everybody? I had an account with them once, but they declined to reinstate it shutdown the account. I don't know why.

So no, they are not an option for everybody.

Not having secrets - MITM isn't necessarily conducted by malicious attackers, but that doesn't mean it's bad. Consider for example a company that wants to identify usage behavior and buys traffic data from an ISP.

Really? Do you think we're all sheeple that are happy to have every facet of our lives tracked? You don't think that someone has a database of every taboo thing you considered buying or seen online, every contrarian political article you've read, etc? You don't think that they're sitting on this cache until they find a way to sell it to anyone that will buy it or score you some way in a Big Data metric? I know people in that industry. They tell me the public isn't ready the handle how much information is for sale about them.

Viewpoints like these feed the sheeple with naivety that they themselves are good people, so the corporations, government agencies and hackers that spy and exploit the gaping chinks in the armor of the Web would certainly have no reason to exploit such good citizens.

You may have misunderstood my point as what I was aiming at is that MITM is always bad for us even if it's not done by malicious attackers but rather by for profit companies.

By not encrypting traffic, web masters who think they don't have secrets are really just selling their users. That's bad.

>Other people do have need for encryption, and by saying "I (currently) have nothing to hide", you are saying that you are fine with a high correlation between "uses encryption" and "is doing something suspicious".

If those agencies had a problem with https, they wouldn't let a Google team popularize it.

Https is, in all likelyhood, as transparent to them as a piece of glass.

Obviously, given that the TLAs can just national-security-letter a CA (if that's even necessary). That doesn't change anything about my recommendation. You should still use HTTPS, always.

It still has an effect of making your traffic not stand out from anybody else's in a DPI. Also, the TLAs are not the only attacker, and HTTPS may not be transparent to them.

The key feature is that it requires a MitM. That is not easy or cheap, compared to simply catch everything with a simple passive beam-splitter. The idea it is easy to get bulk data with XKEYSCORE/PRISM, but requiring the use of QUANTUM, FOXACID, and other fancier tools is not something that cannot be [cheap, undetected, used against everybody] simultaneously.

1) Why not implement passive encryption? Like StartTLS in SMTP? No need for HTTPS; could be part of HTTP/2 over port 80.

2) Pinning?

3) No, let's not do that. I want to be able to access my sites from my 2-year old devices that don't support SNI, like Android 2.3.

Do you really care about accessing sites with 10-year-old mobile devices using only stock apps (emphasis: long term)?

Because it prevents your users' ISPs from inserting extra ads and analytics into your pages.

While looking at my own (ad-free) blog I saw amitabh banchan selling me life insurance. I don't want my readers associating me with this: http://www.hkyantoyan.com/wp-content/uploads/2012/09/AB-bina...

Switched to https shortly after.

And also from them tracking what you read to give you specific advertisements.

Man, it's really all about advertising these days...

Because I can inject code into your page that infects visitors to your blog with malware. The NSAs QUANTUM system does exactly this, waiting for the targeted user to load a non-HTTPS page, then injecting javascript to redirect to an attack site.

AFAIK HTTPS does not by itself prevent this kind of attack. You need to authenticate the server as well as encrypt the connection or you could just be talking very privately to the NSA.

The browsers do a pretty good job of authenticating servers, and we have a few projects in place to look for rouge certificates. It's not perfect, but it will only get better.

Not that many rouge certificates to look for.

Uh, of course it does. If it didn't guarantee the server you were communicating with had the private key for the certificate it is presenting, it would be worthless.

Well, of course the NSA would have the private key for their own certificate. Having the private key for a previously unknown certificate doesn't, in and of itself, prove that you are not the NSA.

Yeah, because the NSA and such don't have access to certificate authorities in the first place, right?

Which is why you are supposed to throw out untrustable Certificate Authorities.

In the same way as TURKTRUST was thrown out by all vendors a few years ago, nowadays you should throw out VeriSign and GoDaddy just as well.

>In the same way as TURKTRUST was thrown out by all vendors a few years ago, nowadays you should throw out VeriSign and GoDaddy just as well.

Have vendors done it? Because users will surely not bother.

Besides, what makes the other CAs' trustworthy?

They are just some companies, with offices, CEOs, etc. Can have ties to the government, deals, pressure on them, or even just plain planted engineers...

Some users might want to be sure that the content of your blog as is rendered on their screen is truly the content of your blog. Or perhaps there are users who do not want others to know which specific posts on your blog they have viewed.

I get your point but you're kind of blowing it out of proportion. A lot of people like myself host really mundane content and that concern is really the last thing on the minds of those types of site owners and their users. You want HTTPS when it's critical that no one manipulate the request and response but for most of us it's not worth the expense and effort. You want SSL on WebMD, Healthcare.gov, your bank website, and those political sites you read when no one is around but if some extra tracking get inserted into the response body of our favorite cat picture site then I think only you and I will notice or care.

SSL everywhere isn't yet practical only due to the expense. It's not that much more effort to secure a site but when you run 10 sites then you're spending $100 a year for those domains. The expense of an SSL certificate each on top of that makes it impractical for solo "webmasters" to secure all their sites. We all know why we should use HTTPS and we do it when it makes sense but it's just not practical 100% of the time yet. Like others have said, this will make more sense once the EFF initiative starts being adopted and getting a free certificate is as easy as apt-get secure-me-please.

Ok sure, your blog has mundane content. But you might use a the same login for your blog as you do for your online banking (with minor changes to the password to make it more "secure", like adding a kid's birth year which people often do). Say you happen to login at a coffee shop, anyone sniffing your WIFI can now pick up your login because your traffic wasn't encrypted.

Most people wouldn't be comfortable with a stranger looking over your shoulder while they logged in. This is the same thing, only you don't think about it.

These things are ALL rare, but why would you want to expose yourself to this?

SSL everywhere is also about improving security for those who don't realize that they might be engaging in behaviors that compromise their own security.

> But you might use a the same login for your blog as you do for your online banking

That is a completely different problem that using https won't solve. It's like building a ship with a hole at the bottom and having a high throughput water pump.

Yes it will, because passive listeners on the network won't be able to catch your password. Only your blog and your online banking will be able to get it, as is intended.

Also note that as tech-savvy people, we have more responsibility in ensuring our users are safe, even from themselves. Sure, the better thing to do would be to educate everyone so they don't reuse passwords. But it will take time, and using HTTPS in the meantime decreases the chance for them to be pwned.

Think of SSL like vaccination. It provides necessary immunity for those rare cases where something bad would happen.

Some users might not like my font choice either, but I don't think the browser should judge my site to be inferior because of that.

If your site has auto-playing sound, would you be opposed to chrome adding the speaker indicator on the tab to alert users that your tab is causing the sound?

A speaker icon isn't making a judgement as to whether that sound is good or bad. Turning no-ssl into a warning is like having the browser judge you for being poor or cheap or incompetent. Not having HTTPS does not mean that you are insecure, it means the site isn't encrypted. There's a difference. Whether the lack of SSL makes you vulnerable to shenanigans depends on a lot of factors having nothing to do with SSL encryption and everything to do with the site content and what one may gain from snooping on your request or manipulating the response. Sometimes there's nothing to gain there.

Some sites are in theory fine without encryption or an alert. Others are definitely not. The problem is that the browser (software) can't possibly know the difference, especially because the sites that "should" be encrypted is a matter of circumstance and varies from user to user. Some might say that the user should know the difference, but I think we can reasonably call that a huge cop-out.

So in order to show an alert whenever sites that should be encrypted aren't, you just have to show an alert all the time. The SSL everywhere movement and Let's Encrypt are about making encryption easy enough for sites like yours that it's practical to do that.

Basically, your site being encrypted, even if it doesn't specifically need to be, helps to improve security of the web as a whole.

At least the browser knows the font choice is yours. The issue here is not with the content of your blog itself, but making sure it's integrity is preserved. Unless you use HTTPS, you don't know what content is sent to the browser, and you don't know who received it.

There is no reason. Your readers will probably not care that the browser tells them your cat pictures are being delivered to them in a non-secure manner.

You shouldn't put in the work to switch over either. But in 2 years it will be easier for you to have a https blog than a http blog and you will naturally switch.

What about when a trusted cat blog starts providing instructions harmful to cats? Or a recipes site sends incorrect information regarding allergies?

Let's think of the idiocy of Slashdot not using SSL on their pages. It's now known that British intelligence services carried out MITM attacks of this popular tech watering hole to attack targets of interest. Given Slashdot knows this has happened and still, no SSL. Sure, they are not processing payment transactions onsite, but they can serve as a MITM puppet and don't seem concerned about this, surely because it might impinge on Dice's ad revenue.

This is why all my blogs/sites are on SSL (or being converted in 1 case). Do you think people really check those md5sum's on the downloads from your OSS project page/blog? Make that unnecessary and use SSL. BTW, my CloudFront charges only went up 5% (i.e. a few bucks) and all my certs cost $2/ea because I stocked up at a sale. It's not a matter of money for most admins.

The question is not "Why SSL" by "Why not?"

If you have any https links on your site, those could be replaced by http links using something like sslstrip. Your site is now the weak link in the chain google->your site->linked site.

Of course sites should be using HSTS to help prevent this, but if the user is visiting the linked site for the first time, HSTS can't protect them.

Someone posted it further down the comment thread, but anyway, here's a reason post I wrote on why you'll want HTTPS even for a static site:

https://www.bitballoon.com/blog/2014/10/03/five-reasons-you-...

Here's a good one - some networks are injecting ads or trackers in the content served by your blog on said networks. HTTPS is a good way of signing your content.

> Does google already reward secure sites with higher search rankings?

They do: http://googlewebmastercentral.blogspot.de/2014/08/https-as-r...

I have no idea what you people are talking about. All of my websites are https but the problem I have is that Google is NOT serving data from secure servers. Open the chrome console on my webpage here and look at all of the errors and warnings. All because Google refuses to serve secure content despite people complaining for YEARS in the forums.

https://www.websmithing.com/gpstracker/displaymap.php

Can't Google spend a little more time securing their own websites instead of telling everyone else to secure theirs?

They do:

http://googlewebmastercentral.blogspot.com/2014/08/https-as-...

Reply on news.ycombinator.com