News for hackers. Stuff that matters.
Re:Cached Chrome Top Million Websites by anonu on Saturday December 31, 2022 @09:47AM (#34196865)
> grep http: current.csv | wc -l

54679

So over 5% of the top 1m sites still don't use HTTPS.

Re:Cached Chrome Top Million Websites by alfu on Saturday December 31, 2022 @10:32AM (#34197263)
If I am not mistaken, 8310 sites offer http and https:

    grep -o -E "://.*?," current.csv | sort | uniq -c | grep -v "1 ://" | wc -l
    8310
Re:Cached Chrome Top Million Websites by philipphutterer on Saturday December 31, 2022 @10:17AM (#34197138)
How about websites that are browsed http first and then redirected? People might browse for a domain without the https prefix for convenience (or old links) and the browser defaults to http.
Re:Cached Chrome Top Million Websites by forgotmypw17 on Saturday December 31, 2022 @10:51AM (#34197482)
Good. Https is an accessibility nightmare and the obsession with making everything https is misguided.
Re:Cached Chrome Top Million Websites by bedatadriven on Saturday December 31, 2022 @10:53AM (#34197504)
What accessibility challenges does https pose?
Re:Cached Chrome Top Million Websites by forgotmypw17 on Saturday December 31, 2022 @11:16AM (#34197770)
The accessibility challenges are all the extra different failure modes HTTPS presents, such as client date offset, older devices, expired certificates, hostname mismatches, and many others.

Security is not the only priority in existence. Sometimes people just want to access the information. And when that is the case, HTTPS can be a huge impediment.

Re:Cached Chrome Top Million Websites by 2Gkashmiri on Saturday December 31, 2022 @11:33AM (#34198001)
yeah... i havent gotten a good response why localhost should scream "insecure" or why i should wikipedia fail if my rtc clock is wonky.

i am not denying "security from snoops while paying with credit cards" and all that banking shit or messaging. heck, email is sent over the clear but we are told to use https to connect to the website (for webmails) using https for "security"...

sure sure security is all good and snazzy but i regularly come across websites who have had certs expired and the website makes it appear as if the sky will fall if i click on continue.

then we have ISPs who use DPI (my current ISP, reliance jio is doing it from day 1) so whats the point of pretending anyway?

Re:Cached Chrome Top Million Websites by rileymat2 on Saturday December 31, 2022 @11:50AM (#34198194)
> email is sent over the clear but we are told to use https to connect to the website (for webmails) using https for "security"

This is not true, most is encrypted in transit. It is not end to end, because your email service stores them (perhaps encrypted perhaps not).

Edit: https://transparencyreport.google.com/safer-email/overview?h...

You can see 84% of outbound is encrypted. This probably is generally a good proxy for the state of email tls transport.

Re:Cached Chrome Top Million Websites by jefftk on Saturday December 31, 2022 @12:17PM (#34198448)
> why localhost should scream "insecure"

Localhost, even with HTTP, is a secure context: https://developer.mozilla.org/en-US/docs/Web/Security/Secure...

What tool is screaming at you that localhost is insecure?

Re:Cached Chrome Top Million Websites by 2Gkashmiri on Saturday December 31, 2022 @01:18PM (#34199075)
browsers. padlock icon is crossed out
Re:Cached Chrome Top Million Websites by jefftk on Saturday December 31, 2022 @01:54PM (#34199478)
I just tested this and don't see that. I compared http://neverssl.com to running "python3 -m http.server" and visiting http://localhost:8000

* Chrome: "Not Secure" on neverssl, "i" in a circle on localhost

* Firefox: Padlock with a red line through it on neverssl, page icon on localhost

* Safari: "Not Secure" on neverssl, no message on localhost

Re:Cached Chrome Top Million Websites by scrose on Saturday December 31, 2022 @01:19PM (#34199084)
They may be using a self-signed cert so it’s https://localhost and the browser is flagging the cert rather than localhost itself.
Re:Cached Chrome Top Million Websites by judge2020 on Saturday December 31, 2022 @01:45PM (#34199378)
> Security is not the only priority in existence. Sometimes people just want to access the information. And when that is the case, HTTPS can be a huge impediment.

I suppose you'd be fine if your government started replacing the content of Wikipedia with their own propaganda/removing critical information about themselves from traffic?

Re:Cached Chrome Top Million Websites by forgotmypw17 on Saturday December 31, 2022 @02:58PM (#34200116)
So far they haven't. Meanwhile, millions of people with older devices cannot use them to access wikipedia.
Re:Cached Chrome Top Million Websites by slim on Saturday December 31, 2022 @03:06PM (#34200207)
you're aware that your government is already doing this, right ? (your argument is invalid)
Re:Cached Chrome Top Million Websites by judge2020 on Saturday December 31, 2022 @03:22PM (#34200341)
how? Edits on Wikipedia are public, including historical monthly backups available over bt all the way back to 2006, and I can ensure Wikipedia servers are serving it correctly by cross-referencing that and the edits. With http, any ISP (whose operators all tend to favor government cooperation) or switch in the middle could sed content to remove or slightly alter known-critical content.
Re:Cached Chrome Top Million Websites by zX41ZdbW on Saturday December 31, 2022 @11:14AM (#34197744)
I have prepared a nice report: the rank of the websites in groups 1..10, 11..100, ... the percentage of TLS and an example of non-TLS website:

https://play.clickhouse.com/play?user=play#U0VMRUNUIGZsb29yK...

    SELECT
        floor(log10(rank)) AS r,
        count() AS total,
        sum(log LIKE '%TLS%') AS tls,
        round(tls / total, 2) AS ratio,
        anyIf(domain, log NOT LIKE '%TLS%')
    FROM minicrawl
    WHERE log LIKE '%Content-Length:%'
    GROUP BY r
    ORDER BY r

    ┌─r─┬───total─┬─────tls─┬─ratio─┬─anyIf(domain, notLike(log, '%TLS%'))─┐
    │ 0 │       6 │       6 │     1 │                                      │
    │ 1 │      61 │      58 │  0.95 │ baidu.com                            │
    │ 2 │     599 │     562 │  0.94 │ google.cn                            │
    │ 3 │    5591 │    5057 │   0.9 │ volganet.ru                          │
    │ 4 │   51279 │   44291 │  0.86 │ furbo.co                             │
    │ 5 │  476181 │  361910 │  0.76 │ funygold.com                         │
    │ 6 │ 3797023 │ 2927052 │  0.77 │ funyo.vip                            │
    └───┴─────────┴─────────┴───────┴──────────────────────────────────────┘

    7 rows in set. Elapsed: 0.844 sec. Processed 7.59 million rows, 43.74 GB (8.99 million rows/s., 51.83 GB/s.)
Re:Cached Chrome Top Million Websites by kedmi on Saturday December 31, 2022 @12:03PM (#34198332)
Excuse my ignorance, what CLI tool did you use to execute this query? Thanks!
Re:Cached Chrome Top Million Websites by zX41ZdbW on Saturday December 31, 2022 @01:25PM (#34199165)
clickhouse-client

Download it as:

  curl https://clickhouse.com/ | sh
Connect to the demo service:

  clickhouse-client --host play.clickhouse.com --user play --secure
Re:Cached Chrome Top Million Websites by _nhynes on Saturday December 31, 2022 @02:30PM (#34199814)
“The 5% rule”