Hacker News Reader

Comment by jasonkester | Hacker News Reader

Can anybody suggest what might be the motivation for this? Beyond the silly "bad people might tamper with the cat picture you're shown" one that is always given? Chrome hates http with such a passion that there must be some evil motive behind it that I'm not seeing.

Because they just keep making life more difficult for websites that don't need SSL.

So now in addition to seeing a scary icon on the url bar with a scary message, my users are going to have to click past an interstitial banner just so they can visit a website and read silly travel stories. Chromium will try their best to convince them to leave, lest some nefarious agency on their home wifi substitute alternate silly travel stories that somehow cause them harm. In the 20 years the site has been live, I skeptical that this has happened often enough that we need to get Google involved.

It's frustrating.

View on HN

I don't know Google's motivation but frankly I welcome TLS everywhere on the public-facing web now that certs are free thanks to LetsEncrypt.

For me, it comes down to two things:

1. Privacy. When I'm on non-private networks, its nice to have assurance that other people aren't able to get the specific contents of what I'm viewing.

2. ISP bad behavior. A number of ISPs have been doing things like injecting ads or other trackers into plain-HTTP sites. https://www.infoworld.com/article/2925839/code-injection-new...

Hopefully, LetsEncrypt is and will always be incorruptible organization. There was never a case of a community project being taken over by greedy capitalists. Oh wait...

I personally have put a lot of faith in them but there's also a lot of alternatives in case they were to flop or become corrupted:

1.https://zerossl.com/letsencrypt-alternative/

2. Cloudflare will issue you free TLS certs (assuming you're okay with them doing TLS termination). I assume other CDNs / caching proxies with free plans will also do this.

3. https://www.buypass.com/ssl/products/acme

4. https://www.sslforfree.com/

I'm sure there's more, but that's just what I could quickly find.

There are a lot of safeguards like certificate transparency logs. They would be caught.

99% of people if you tell them to go to website.com will type website.com into the address bar. This will send an unencrypted HTTP request on port 80, even if the site supports HTTPS. This initial navigation can be intercepted by a MITM and redirected, spoofed, whatever (coffee shop WiFi is a great example of where this could be dangerous). Making the default navigation use HTTPS negates this attack.

As a small side bonus, it also reduces navigation latency by several RTTs, as there is no longer the need for a connection to port 80 HTTP that only always gets redirected to HTTPS.

On relatively modern browsers, this is obviated if the DNS name you type into the browser has HSTS preload.

As well as preloading your corporate web site, HSTS preloading can be done hierarchically. For example all of .google, .dev, and .foo is HSTS preloaded, sites in those TLDs don't have plaintext HTTP in modern browsers. Perhaps some day the US government will preload .gov

(Plaintext HTTP still works for these names, a tool like curl doesn't obey HSTS -- it just can't be done in your web browser because it'll get upgraded to an HTTPS request)

Mozilla has taken similar steps to encourage websites to implement HTTPS, and I can't say whether you believe they share Google's evil motivations, but it's a clear trend across browser vendors.

Certificates are free now and not necessarily any more difficult to install and maintain than any of the other software you need to run even a basic website. It's something relatively simple I can do to ensure the integrity of the content I want people to look at, so why not?

that there must be some evil motive behind it that I'm not seeing.

Google wants to control the entire Internet, and that means centralising power. HTTPS requires certificates issued by a small list of CAs, and they can revoke them too.

Combine that with Google's efforts and those of others of locking down the whole stack (all in the name of "security", of course), and you can see just how much power to censor "inconvenient" information they've accumulated.

People like to cheer on the companies fighting the "bad guys", not giving a second thought to letting them have more power --- nor considering that this power may one day even be used against them. Of course, this power will initially only be used for fighting malware and phishing. Then they'll start revoking sites for "misinformation"...

There's a good reason why SciHub and LibGen are accessible via plaintext HTTP.

"Those who give up freedom for security deserve neither", as the classic saying goes.

> Can anybody suggest what might be the motivation for this?

The push for HTTPS everywhere started with HR4681[1] both of which were reactions to Snowden revelations.

> Beyond the silly "bad people might tamper with the cat picture you're shown" one that is always given?

Someone who is able to tamper with the cat picture you are seeing can also inject arbitrary code into your computer, so there is that.

Also, thanks to the push for HTTPS everywhere, a large volume of traffic now goes through CloudFlare enabling them to do that on behalf of state actors etc (I am not claiming they do it, but it is kind of ironic that the least friction thing for me to enable HTTPS on a whole bunch of sites was to put a MITM ;-)

Totally love CloudFlare BTW. The free level covers what I need. Still, it is ironic.

[1]: https://www.nu42.com/2014/12/https-everywhere-and-hr4681.htm...

Why single out HR4681? The IETF's Best Common Practice #188 "Pervasive Monitoring Is an Attack" is months earlier in terms of reactions to Snowden and is a direct trigger for this work which doesn't involve stoner thinking ("What if, like, the government snooping is actually reverse psychology to trick us into hiding stuff from them")

Because, at the time, HR 4681 was heralded as _limiting_ the U.S. government's ability to monitor and retain communications of U.S. citizens when, in fact, coupled with omnipresent encryption actually explicitly made it legal to retain such communications indefinitely.

Copying the plain language here:

"... Limitation on retention.–A covered communication shall not be retained in excess of 5 years, unless– ... (iii) the communication is enciphered or reasonably believed to have a secret meaning;"

> Someone who is able to tamper with the cat picture you are seeing can also inject arbitrary code into your computer, so there is that.

Someone can just inject arbitrary code into your computer using a site with an SSL cert. It's very easy to get a free one nowadays, judging from the other threads. Why are middle-men so important to protect against? The site owners are the usual source of attacks.

> Chrome hates http with such a passion that there must be some evil motive behind it that I'm not seeing.

I think it is just that Google wants exclusive access to your data. With http, your ISP can also understand your browsing habits. Then they devalue Google's ad profile that they have painstakingly created. So Google is pushing for https, which would exclude ISPs and other intermediaries from profiling you. Note that Google's ability to spy on you is un-curtailed since you are using Chrome and even signing in with your google account.

if you want the cynic's version, https will prevent ISPs or other nefarious operators between you on the website's hosting provider from swapping out the website's ads with their own ads. google's customer is the website operator, so they want to protect that relationship.

(the less cynical interpretation is that all the other non-ad content on that website is also valuable and shouldn't be modified in transit)

Widespreading mass surveillance (US PRISM, China GFW) is a part of reason.

Reply on news.ycombinator.com