• @[email protected]
      link
      fedilink
      English
      1351 year ago

      And HTTPS relies on hosts managing SSL certificates. Web services don’t use them until it hits a critical mass, then it becomes weird and broken when you aren’t using it.

      This just needs some time to settle in.

      • DarkThoughts
        link
        fedilink
        751 year ago

        I remember when absolutely no one used https and then in a matter of a couple years things got really fast. Now you can easily browse with https required and only occasionally find the odd website that doesn’t use it (mostly some internet relic). That was such a great transition when it happened though.

          • @Chobbes
            link
            351 year ago

            Let’s Encrypt was a godsend. Getting a TLS certificate before sucked.

            • @kautau
              link
              261 year ago

              Yes. Thank these folks:

              Mozilla employees Josh Aas and Eric Rescorla, together with Peter Eckersley at the Electronic Frontier Foundation and J. Alex Halderman at the University of Michigan. Internet Security Research Group, the company behind Let’s Encrypt, was incorporated in May 2013.

              They created the ACME standard, the open source community got on board, and soon enough everyone bought in, a massive step forward for Internet security and the benefit of open source.

              • @[email protected]
                link
                fedilink
                131 year ago

                So Firefox is basically the GOAT when it comes to internet security and privacy? They should team up with the signal guys.

        • @Rade0nfighter
          link
          281 year ago

          Google preferring https sites was the motivator I saw for client demands.

          SEO scores feed into the PPC cost in AdWords so all of a sudden people were crying out for their sites to “have the padlock icon” because what’s 20 bucks for a cert when you’re spending thousands of dollars a month

        • @Chobbes
          link
          111 year ago

          HTTPS is pretty much ubiquitous these days. It’s mostly an issue on a few smaller websites and blogs that people haven’t cared enough about to bother getting a cert for… But even that is rapidly going away. Even if a website has HTTPS, it’s not entirely uncommon for some resources to be loaded over regular HTTP, and sometimes websites don’t properly redirect you to the HTTPS version, making it possible to end up on the unencrypted version by accident.

          HTTPS is great, and Let’s Encrypt has been such a godsend for it… That said it’s not perfect, and also has some limitations on its own, and not every website implements all of the mitigations that help HTTPS do its job, so HTTPS adoption is a bit of a mixed bag. A big issue is that when you try to secure a previously insecure protocol this often makes downgrade attacks possible. For instance, if you just type “lemmy.world” into your web browser, and if somebody is able to intercept those packets, they could just reply “hey, I’m the lemmy.world, I don’t do HTTPS, let’s talk unencrypted” and your browser would have no idea that it should be talking HTTPS instead of HTTP. One way to avoid this problem is just by explicitly telling your browser to use HTTPS by going to “https://lemmy.world”, which tells it to talk over HTTPS, and in that case the man-in-the-middle wouldn’t be able to tell you to use HTTP instead and won’t be able to provide a valid certificate for lemmy.world (hopefully, anyway :P). This is also what HSTS is used for… It’s a header that the webserver sends to your browser saying “only talk to me with HTTPS”, so once you’ve visited a site your browser will remember that it should only use HTTPS with it in the future. This only applies to websites which you’ve visited before, though… To improve the protections a little bit there’s HSTS preload lists (basically your browser can have a list of HTTPS websites baked into it, so it knows when to only use HTTPS before you even do), https://hstspreload.org/… Or we could just solve this problem with DNSSEC and DANE, which allows you to look up the TLS certificates that should be used for the domain in DNS.

          That’s probably more of a rant than you wanted 😅… But basically, HTTPS adoption is really good these days in the sense that most websites will have a TLS certificate available (probably from Let’s Encrypt!), and will speak HTTPS. But, there’s still areas where we can improve internet security. I’m not sure how the adoption of HSTS is going, but I think it’s pretty low. DNSSEC adoption is abysmal and we should probably fix that.

          • @[email protected]
            link
            fedilink
            61 year ago

            HTTPS is pretty much ubiquitous these days.

            It never used to be, though. The same will happen with ECH/ESNI eventually, especially if browsers push for it like they did with TLS.

            • @Chobbes
              link
              31 year ago

              Yeah, especially before Let’s Encrypt recently it was a complete disaster. Definitely will be better support for ECH soon.

              • @[email protected]
                link
                fedilink
                21 year ago

                Cloudflare helped quite a bit too, although I wouldn’t call that “true” TLS as part of the connection was unencrypted. In the old Cloudflare days before Let’s Encrypt existed and before Cloudflare had their self signed origin certs, often the connection between the end user and Cloudflare was encrypted, but the connection from Cloudflare to the origin server wasn’t. People were celebrating Cloudflare as a way to easily add TLS to a site, but in the background it was still plain text!

          • @[email protected]
            link
            fedilink
            31 year ago

            Even if a website has HTTPS, it’s not entirely uncommon for some resources to be loaded over regular HTTP

            I think all browsers will refuse to load a resource over HTTP if the website is served over HTTPS.

            • @Chobbes
              link
              41 year ago

              This is not true. Browsers will happily use http even if https is available, and without other mitigations like HSTS or DANE there is no way for your browser to even know that a site supports https. Many websites will forcibly redirect you to https, but this is the server telling you “hey connect with https instead”. A man-in-the-middle can simply not tell you to use https. Browsers have started marking http sites as insecure and will warn you about sending passwords, however.

              • @[email protected]
                link
                fedilink
                41 year ago

                I think I phrased it wrong, or there is a confusion with terms.
                If a page is loaded with HTTPS, then images/CSS/JS/iFrames (resources) will not load over HTTP. The resources also have to be served via HTTPS.
                If a page is loaded over HTTP, then resources (images/CSS/JS/iFrames) can be loaded over HTTPS.

                My objection was to the “even if a server has HTTPS, some resources will still load over HTTP”

                • @Chobbes
                  link
                  41 year ago

                  As far as I know, this is not strictly true either. I believe most browsers currently block mixed active content like JavaScript or iframes, but will happily load images and such over HTTP (although I would not be surprised if this is changing).

        • @[email protected]
          link
          fedilink
          61 year ago

          The only place (other than old unmaintained sites) I’ve seen no TLS has been promotional sites for video games. Possibly something hastily thrown together?

    • @[email protected]
      link
      fedilink
      English
      81 year ago

      Apparently, Cloudflare already supports ECH, and a not-insignificant number of websites use them.

    • @[email protected]
      link
      fedilink
      11 year ago

      Wouldn’t it be better if reverse proxies simply had a “default key” meant to encrypt the SNI after an unencrypted “hello” is received?

      Including DNS in this seems weird.

      • @[email protected]
        link
        fedilink
        11 year ago

        What would stop a MITM attacker from replacing the key? The server can’t sign the key if it doesn’t know which domain the client is trusting.