Life Is About to Get Harder for Websites Without HTTPS

Re:Life Is About to Get Harder for Websites Without HTTPS by jakobbuis on Wednesday July 12, 2017 @02:38AM (#14750574)

This fails utterly when you can't control your clients. My student society for example ran into this problem. Students bring their own laptops and installing our root certificate on all of them is infeasible (if they even would allow us to do so). As a consequence, we need to expose critical internal services on the public internet, some of which contain private user data.

[ Parent | on HN ]

Re:Life Is About to Get Harder for Websites Without HTTPS by Dylan16807 on Wednesday July 12, 2017 @02:45AM (#14750613)

If you let any student that brings their own laptop connect to it, then it's already pretty darn public.

And you don't actually have to expose it to the internet to get a certificate, you only have to give it a public name.

[ Parent | on HN ]

Re:Life Is About to Get Harder for Websites Without HTTPS by Freak_NL on Wednesday July 12, 2017 @03:21AM (#14750746)

Additionally, if you let anyone bring their own device in a diverse semi-public environment like a school, you owe it to the students and faculty alike to provide them with some protection against creative types placing fake wifi access points in busy places, trying to play man-in-the-middle for any credentials and other stuff sent to your local services. HTTPS does that.

Using a proper FQDN for each service only makes everything easier to maintain.

[ Parent | on HN ]

Re:Life Is About to Get Harder for Websites Without HTTPS by BillinghamJ on Wednesday July 12, 2017 @02:46AM (#14750617)

You don’t need to expose them. You need to use public DNS records, but there is no reason those records have to point to public IPs.

e.g. my company uses *.int.cuvva.co which all point to IPs in the 10.0.0.0/8 block, but we still have HTTPS certificates for all of those.

[ Parent | on HN ]

Re:Life Is About to Get Harder for Websites Without HTTPS by will_hughes on Wednesday July 12, 2017 @02:48AM (#14750622)

> As a consequence, we need to expose critical internal services on the public internet, some of which contain private user data.

No, you just need to have a public DNS entry, no need for that service to be reachable from the internet.

foo.example.com can resolve to your private RFC1918 address, when you send the CSR to a CA, they'll verify your ownership of example.com.

[ Parent | on HN ]

Re:Life Is About to Get Harder for Websites Without HTTPS by cm2187 on Wednesday July 12, 2017 @03:38AM (#14750812)

A public domain name costs the price of a coffee (and less than a raspberry pi) and you can get a certificate for free with Let's Encrypt. There is really no reason to resort to a private CA unless you want to MITM your client's connection.

You don't need to expose your server to the public internet to use let's encrypt. I use DNS authorization and it works perfectly.

[ Parent | on HN ]

Re:Life Is About to Get Harder for Websites Without HTTPS by kpcyrd on Wednesday July 12, 2017 @03:52AM (#14750868)

Even if you could I would highly recommend against doing that, given that this would grant you access to every https connection that isn't hpkp secured.

I actually have all webservices in my home network secured by https, all you need to do is click a cheap vps, install nginx and tinc, and then proxy /.well-known/acme-challenge/ to your internal servers. Either setup domain or ip hijacking so the public IP is routed inside your lan. Done.

If I can do this for me and my cat in my spare time, you can do this for your university.

[ Parent | on HN ]

Re:Life Is About to Get Harder for Websites Without HTTPS by wfunction on Wednesday July 12, 2017 @03:47AM (#14750847)

> My student society for example

> need to expose critical internal services on the public internet, some of which contain private user data.

The heck? Are they aware of this? Might you get sued for this?

[ Parent | on HN ]

Re:Life Is About to Get Harder for Websites Without HTTPS by mrmondo on Wednesday July 12, 2017 @02:43AM (#14750605)

If you can’t control your clients - maybe use a captive portal style landing page with a link to install the local certificate or something along those lines, it’s also useful to have a wireless network (SSID/VLAN) for BYOD that just has internet access and as such doesn’t need the very and one that has access to internal services that does.

[ Parent | on HN ]