How Far Have We Come With HTTPS? Google Turns On the Spotlight (networkworld.com) 84
alphadogg writes from an article on NetworkWorld: HTTPS is widely considered one of the keys to a safer Internet, but only if it's broadly implemented. Aiming to shed some light on how much progress has been made so far, Google on Tuesday launched a new section of its transparency report dedicated to encryption. Included in the new section is data highlighting the progress of encryption efforts both at Google and on popular third-party sites. "Our aim with this project is to hold ourselves accountable and encourage others to encrypt so we can make the Web even safer for everyone," wrote HTTPS evangelists Rutledge Chin Feman and Tim Willis on the Google Security Blog.
Congrats Slashdot! (Score:5, Insightful)
This is the first time one of these stories have come up and slashdot has had HTTPS enabled!
Re: (Score:1)
Re:Congrats Slashdot! (Score:4, Funny)
Re: (Score:1)
To me it's a honeypot [schneier.com]. I wonder if there is a 'conflict' between the URL and its content :-)
Re: (Score:2)
Holyshit, you're right! The cert for this site is only 2 days old. Didn't even notice until you mentioned it!
Re: (Score:1)
This [eff.org] might help.
Re: (Score:2)
Re:Congrats Slashdot! (Score:5, Informative)
SSLLabs gives A rating
Protocols
TLS 1.2 Yes
TLS 1.1 Yes
TLS 1.0 Yes
SSL 3 No
SSL 2 No
Protocol Details
DROWN (experimental) No, server keys and hostname not seen elsewhere with SSLv2
(1) For a better understanding of this test, please read this longer explanation
(2) Key usage data kindly provided by the Censys network search engine; original DROWN test here
(3) Censys data is only indicative of possible key and certificate reuse; possibly out-of-date and not complete
Secure Renegotiation Supported
Secure Client-Initiated Renegotiation Yes
Insecure Client-Initiated Renegotiation No
BEAST attack Not mitigated server-side (more info) TLS 1.0: 0xc014
POODLE (SSLv3) No, SSL 3 not supported (more info)
POODLE (TLS) Inconclusive (Timeout) (more info)
Downgrade attack prevention Yes, TLS_FALLBACK_SCSV supported (more info)
SSL/TLS compression No
RC4 No
Heartbeat (extension) No
Heartbleed (vulnerability) No (more info)
OpenSSL CCS vuln. (CVE-2014-0224) No (more info)
Forward Secrecy With modern browsers (more info)
ALPN No
NPN No
Session resumption (caching) No (IDs assigned but not accepted)
Session resumption (tickets) No
OCSP stapling No
Strict Transport Security (HSTS) No
HSTS Preloading Not in: Chrome Edge Firefox IE Tor
Public Key Pinning (HPKP) No
Public Key Pinning Report-Only No
Long handshake intolerance No
TLS extension intolerance No
TLS version intolerance No
Incorrect SNI alerts No
Uses common DH primes No, DHE suites not supported
DH public server param (Ys) reuse No, DHE suites not supported
SSL 2 handshake compatibility Yes
Miscellaneous
Test date Wed, 16 Mar 2016 19:51:39 UTC
Test duration 125.443 seconds
HTTP status code 200
HTTP server signature Apache/2.2.3 (CentOS)
Server hostname star.slashdot.org
Re:Congrats Slashdot! (Score:4, Interesting)
You know what is good about HTTPS these days:
- HTTP/2 using HTTPS is faster than HTTP/1.x without HTTPS and it's getting easier to deploy it. For example by using the H2O webserver ( https://h2o.examp1e.net/ [examp1e.net] ) as a proxy, it comes with built in SSL/TLS library for easier deployment and support for replicating sessions.
HTTPS itself is becoming easier to deploy and manage:
- HTTPS doesn't need a dedicated IP-address any more (older browsers/operating systems had problems with the HTTPS equivalent of 'virtual hosts'):
https://en.wikipedia.org/wiki/... [wikipedia.org]
- certificates are available for free with an automatic request and renewal system. So no more messing around, you can automate it. -> with Let's encrypt Beta: https://letsencrypt.org/ [letsencrypt.org] and for example with acmetool: https://hlandau.github.io/acme... [github.io].
There are finally ways to fight the silly CA-system, not completely, but things are improving.
For regular visitors on a site you can add headers which will prevent an other CA issuing a rogue certificate for your site.
https://developer.mozilla.org/... [mozilla.org]
Re: (Score:1)
That method of certificate pinning assumes that it will not be tampered with while in transit on the first use. Yes, it works similar to SSH, but unless the web visitor is verifying the certificate signature via an out-of-band communications channel, it's trivial for some hostile entity to intercept the page on the first request and replace that header with their own header. Then continue to MITM the site without the user encountering a rogue certificate error.
The only sane solution at the moment is eithe
Re: (Score:2)
Obviously at first visit the CA-system still applies, so the certificate was/were issued based on some verification process. So that is a form of out-of-band communication channel. It's the most used channel on the Internet right now. This is just an improvement.
What a lot of attackers want to prevent is detection and with this system in place, the risk of detection also becomes much higher.
Anyway, you can also get your site added to the lists that are included in browsers. Chrome and Firefox use that too (
Re: (Score:3)
HSTS and HPKP provide provide cookies that, while far more unconvenient to abuse, are enormously more insidious. You can't really block third-party H??? cookies, making them session-only defeats their stated purpose, and usual cookie-handling extensions don't manage them either.
Thus, anyone who cares about privacy needs to disable both HSTS and KPKP, which is sad as such people tend be those most at risk of state-level attacks.
So we indeed urgently need DANE. For now, both Chrome and Firefox have it effec
Re: (Score:2)
How are they cookies ? How does the server learn what the client/browser knows ?
The client/browser doesn't send what the it knows to the server and AFAIK there is no Javascript API or similar to check it from within the page.
Re: (Score:2)
You get only 1 bit per hostname but can use any number of them. You then make a query to http://bit0.example.org/ [example.org] http://bit1.example.org/ [example.org] http://bit2.example.org/ [example.org] and so on, recording which succeeded and which failed. For HSTS you query http and have https either not work or return a different answer, for HPKP you query https and have test servers use certificates signed by a valid CA that doesn't match the pin.
You don't even need javascript to read the answers, both to display something to the user (pie
Re: (Score:2)
I understand your point now. But that's a lot of trouble to go through and it would take a lot of requests to identify a single user. There are much easier and more stealthier ways to do that.
Re: (Score:3)
Unless you're reading on mobile, then it defaults to "m.slashdot.org" over plain http.
Re: (Score:2)
Mobile slashdot has a LOT of issues.
It's definitely easier to just give up on logged-in browsing over a mobile device and post as AC. I know I do.
Re: (Score:2)
On the other hand, the old DICEy overlords at Sourceforge can't even keep their https working, at least for prdownloads.sourceforge.net [sourceforge.net].
Google knocks Apple, Bing and Microsoft (Score:5, Informative)
Notice that Apple, Bing and Microsoft are all knocked for NOT running a "Modern TLS Config" and NOT using HTTPS by default. (I actually had to check that for myself - it was hard to believe that major companies are still NOT doing HTTPS by default - I enforce this even on my little podunk sites - but it was true!)
kick 'em again, harder! (Score:2)
Forbes.com:
Site works on HTTPS Y
Modern TLS Config N
Default HTTPS N
SNRK...
wait, "Other Top Sites" ?!
Re: (Score:2, Insightful)
Why is it better to force users to use https instead of letting them choose? I hate this modern trend when removing features is considered "progress".
Re: (Score:2, Insightful)
Adding security is now removing features?
Fat, drunk and stupid is no way to go through life, son.
Re:Google knocks Apple, Bing and Microsoft (Score:5, Insightful)
And because we need to ~double the amount of data used by all the hamster forums, cat videos and aircraft curation guides, especially when a lot of the world's users are on slow or data-limited connections?
Look. I get that it's good to ensure that there's no injected content, and that you know you're connected to the site you want - but that's only true for 1% of the population. The rest of the world wouldn't know the difference between https://www.example.com/member... [example.com] and https://www.example.com.member... [example.com.members]. Both "secure" because they're HTTPS, right?
Factor in all the browsers deciding that privately-signed sites are worse than plain http, that no-one needs to actually SEE the protocol, or the URL, that all the certs are issued by a cabal of companies who just see the benefit of charging for a NUMBER, but barely doing validation ... but sure. "Adding security". Right.
Re: (Score:2)
Apple, Bing, and Microsoft are all sites that collect personal data. They ask you to log in, which means that you are either sending them a password or you already have a cookie. They are in the class of site that should be using HTTPS by default.
There are many sites that do not collect any personal data. Either they have no login at all, or they have a login procedure where you don't have to provide any significant amount of personal data to get a login credential, just a handle and a password. (That passw
Just one problem (Score:1)
Well, not just one problem, but it's a big one, and typically overlooked. It's nice we now encrypt everything, but we're still relying on commercial parties to "verify identity" and to protect us... from anyone they don't take money from. That's a big one, it's fundamental, and it doesn't scale. Worse, any currently in use alternative, like relying on governments, isn't better.
Re: (Score:2)
Actually, it DOES scale, which is generally why HTTPS (used to provide "one-way" authentication of server identity) thrives on top of its CA-signed X.509 certificates.(As opposed to a point-to-point world in which each user would have to individually trust the credential of every site they visited, like most SSH or PGP implementations.)
Re: (Score:2, Insightful)
Exactly. It's just more theater. 99% of those "cheap" ssl certificates are not validated AT ALL. People are blindly putting trust into a system that has none.
And on top of this, SSL is an exceptionally expensive computation. It takes rather expensive dedicated hardware to handle at any meaningful rate. (go play with the opensssl speed tool to see for yourself)
Re: (Score:2, Informative)
It doesn't matter that SSL is computationally expensive, because you don't use it to encrypt the entire session. Instead, you use it to exchange symmetric encryption keys in a secure manner and *those* keys (and algorithms) are what is used to encrypt the session. Even an old Xeon 5160 could encrypt 100-150 MB/s with AES-128 which is enough to keep up with a 1Gbps NIC.
Modern CPUs are even faster [calomel.org]. Those are per-core numbers, so multiple by 4/8/12/16 (however many cores you have).
Backing the wrong horse (Score:4, Interesting)
Re: (Score:2)
Doesn't "perfect forward secrecy" already do this? This is already available in all modern browsers, it's just up to the servers to implement it. SSL labs only gives A/A+ to servers that implement it.
Re: (Score:3)
Doesn't "perfect forward secrecy" already do this? This is already available in all modern browsers, it's just up to the servers to implement it. SSL labs only gives A/A+ to servers that implement it.
PFS is a step beyond what the AC suggested. The suggestion was that randomized session keys be exchanged for each session, and that is done even without PFS. Without PFS an attacker who records the communication and later obtains the private key of the server can use the private key and the recorded data stream to recover the random session key, and then decrypt the data. With PFS, the attacker must have the private key of the server (or a private key and a corresponding cert that appears to be from that se
Re: (Score:2)
That is why the two functions should be separated. Authentication and encryption are two different things. The certificate should only be used to establish identity and then exchange randomized encryption keys, used for this session only.
That is how it's done in TLS.
The problem is that a bad cert allows an attacker to "prove" they're the person you want to talk to. So then you exchange random encryption keys with the attacker and proceed to send data. Oops.
Re: (Score:2)
Randomised session specific keys are used in tls.
Unfortunately the "traditional" ciphersuites establish those keys by having the client generate them and encrypt them with the private key associated the server's certificate. This means that if the private key is later compromised all previous sessions can be decrypted. The DHE and ECDHE cipersuites avoid this problem.
Re: (Score:2)
coercing a CA might be revealing though, wouldn't it be easier to coerce a particular server owner?
Re: (Score:1)
Or more likely (as in they-are-already-doing-this)... record TB's of encrypted traffic until they can seize the server (and thus the certificate). Once they have the server certificate, they can decrypt every session that has ever been encrypted with it.
Re: Backing the wrong horse (Score:2)
Re: (Score:1)
Doesn't apply. With the server key, you can do the exact same math as the server to generate the exact same master secret and decode the entire stream.
(I've been building systems to do this for over a decade. Sure, it's easier if you happen to be the load-balancer -- i.e. "server" -- in the equation, but out-of-band monitoring of SSL is Very. Real.)
Re: (Score:2)
True ephemeral keys will be an issue, however this does present an avenue for man-in-the-middle compromises. (and has been brought up in various security circles.) To date, only one customer has ever asked why select sessions weren't being processed -- this was a major US University with SSLv1 enabled that was allowing 56bit keys. Those sessions don't use the server key, so we can't decode them. (given a few days, we could recover a single session key, being 56bit DES.)
Also, computers are very bad at doing
Re: (Score:2)
Can you tell anyone if you get a secret FISA order? No. So how could that be revealing?
Re: (Score:2)
that's why its so much easier to just grab slashdot's private key, assuming anyone ever gave a shit about what was said on slashdot. I"m skeptical myself
Re: (Score:2)
you would suck at counter-intelligence. the actions of an agency based CA-level compromise would be different than acting on compromising of individual corporations servers.
Re:Backing the wrong horse (Score:4, Interesting)
HTTPS isn't that safe. Any agency that can coerce one of the numerous CA's can snoop traffic quite easily.
While your concerns are real, I think they're overstated.
A coerced CA cert does allow MITM attacks, but they have to be used very carefully and on a targeted basis, because if they're used too broadly it will be noticed. A TLS MITM attack is very noticeable to anyone who is looking. Google Chrome has caught a few subverted CAs now, thanks to certificate pinning of intermediates for Google, Verisign, GeoTrust and some others. Firefox pins large numbers of intermediates, for lots of domains. I think other browsers are also getting into it.
Of course Eric Schmidt is an avid fan of the surveillance society so thats why they weren't going to back anything less centralised than CA-based HTTPS
Nice cheap shot. In fact Google has a couple of significant projects to address the shortcomings of the CA system. One is to increase pinning, but that's kind of a hack. The other is the Certificate Transparency [certificat...arency.org] project, which aims to ensure that any certificate produced by any CA for any domain is visible to the owner of that domain. If that succeeds covert certificate issuance will be impossible.
At bottom, the problem with the CA isn't centralization, it's more complicated than that. The CA system is decentralized in the sense that there are many CAs... but that makes every one of them a single point of failure. In some ways we'd be safer with a truly centralized CA system, because then we'd have one single point of failure rather than a few hundred. The semi-decentralized system we have is pretty decent... if we can enable the world to easily recognize improperly-issued certificates. Certificate Transparency is one good way to do that. I'm also a fan of the Convergence [wikiwand.com] system, but in addition to the existing CA system, rather than as a replacement.
In any case, although the CA system has some issues, and we have seen a handful of cases where they've been exploited, by and large it works very well, securing more connections and more data than anything else ever has. We'd be foolish to replace it, but augmenting it to address the problems is a good idea.
Re: (Score:1)
That's why we need DANE [wikipedia.org]. Which makes it more difficult for rogue agencies (or rogue CAs) to issue certificates for a particular domain.
Certificate pinning could also work, but doesn't scale unless it's a distributed lookup service.
Re: (Score:2)
Re: (Score:2)
https is not perfect but refusing to use it is a serious case of letting perfect be the enemy of good. Furthermore google has been one of the main driving forces behind the introduction of http key pinning which makes it much harder to perform MITM attacks successfully and much more likely that an organisation attempting a MITM attack will be noticed.
Re: (Score:1)
LUKS [wikipedia.org] can have the container grown (though it's a multi-step process including growing the filesystem after growing the container, there is potential for a good UI to be developed to support this) and has at least one application supporting it on windows.
PAR2 is pretty much the standard for external redundancy. Internal redundancy still risks that a file could be damaged in a way (loss of header) that makes the file unrecognizable, even if it contains redundant blocks inside of it. PAR2 resists this as eac
Comment removed (Score:5, Informative)
Re:googles ultimate end goal is far more impressiv (Score:5, Informative)
Google, er, Alphabet didnt really get a rock in their shoe about encryption until Edward Snowden
While I think we should all be very grateful for Snowden's revelations, that's not true. Google was really serious about encrypting everything long before Snowden's revelations.
For example, Gmail was the first major webmail service to provide users the option of only using SSL, back in 2008 or so. Google turned on SSL for web searches in 2011. The design of SPDY, later adopted by the IETF as HTTP2, started around 2010 and from the beginning had no unencrypted mode (though the IETF insisted on adding one).
Once it was revealed that the US government had placed secret taps on links between google datacenters
Google actually started work on encrypting all of those data center links long before Snowden's information came out, though Snowden definitely did light a fire under the project, causing it to get fully deployed very quickly. Snowden probably also had a lot to do with Google's decision to completely disable non-TLS traffic for many of their services (IIRC it was 2014 when gmail and search went TLS-only).
Google owns a browser, so that browser adopted SSL, then TLS as a mandatory connection parameter for google services.
Chrome supported SSL and TLS before Snowden, and ownership of Chrome had nothing to do with making encryption mandatory for Google services, which was done in a browser-agnostic way. Chrome did provide a platform for Google to experiment with other improvements, though, such as certificate pinning, SPDY and QUIC. SPDY and QUIC are mostly about performance, but as I mentioned above Google build encryption into them from the ground up and never even bothered with unencrypted versions.
after a year, the titty got tougher and HSTS was the norm on some of the largest web content providers on the internet.
HSTS also predated Snowden, and Google even started using it for some services before Snowden. But, yes, again Snowden spurred much wider adoption. Which is awesome.
But slashdot, its only getting good.
Indeed. All new Internet protocols and standards now specifically address anti-surveillance in their designs, and lots of academic research is focused on new technologies to make surveillance hard. This is actually an even bigger change than the TLS push, etc., indicates. Prior to Snowden, preventing surveillance was not a design goal. If it happened, it happened by accident. No more. It's now a design goal for much of the tech industry.
So when is /. going to use https? (Score:2)
(walks away mumbling something about UTF...)
SNI is about 98-99% supported (Score:2)
An X.509 certificate with multiple subjectAltName entries, sometimes called a UCC, works in all browsers but has two drawbacks. First, a multi-SAN certificate may be more expensive to obtain from a commercial certificate authority. Second, a multi-SAN certificate is designed for multiple sites operated by one entity, not a shared hosting environment with a bunch of unrelated sites behind one IP.
Using multiple certificates on port 443 of one IP address needs Server Name Indication (SNI). This works on both m
Google must be siding with Criminals and Terrists! (Score:1)
Re: (Score:3)
It's called LetsEncrypt. You only have to turn over appropriate access to your server to client software (even though to trust it you'd have to review the code or write it yourself). And your web server has to be able to access the LE servers, so you (currently at least) have to permit outbound access from a device providing the website (there are larger configs where you could mitigate that somewhat but this is the simple case).
The client hits the LE servers, gets a string to write to a server-specified lo
Re: (Score:2)
It seems you have some grudge against Let's Encrypt, but most of your complaints aren't actually true. To begin with, while the webroot verification you referred to is the most common method, DNS verification is also available as part of the ACME standard, with preliminary (but functional) support implemented in Let's Encrypt. For webroot verification the client software does not need to run on the web server itself; the challenge can be met by manually writing the challenge file to the expected location, o
Re: (Score:3)
Use an ACME client to obtain a domain-validated certificate without charge from the Let's Encrypt CA. If you have a VPS or bigger on its own IP address, you can install the official Let's Encrypt client. If you have shared hosting, you can install the sudo-less client [github.com], put the resulting ACME response page at the appropriate well-known URL (instead of running sudo python), grab the certificate, and then file a support ticket with your host to get the installed.
oh yeah google? (Score:2)
HTTPS ? Why the heck use it on /. ? (Score:1)
As in the subject line: Why the heck does /. thinks it should be using it. There is absolutely nothing going on here for me, as a reader and occasional poster, to warrant it.
I definitily start to dislike all those "lets go with the times" sites who think that their informative articles, jokes and/or cat videos need to be send over HTTPS only. Where is my choice in the matter ?
Interception (MITM) attacks are only usefull if either side is doing something that needs to be kept secret, and where its value