Lots of networking equipment works over HTTP only, still.
I am actually really pissed off that I can not use Chromium password manager to save HTTP credentials for these devices.
MikroTik has supported https for a very very long time, though it comes disabled by default and even if it didn't it wouldn't work because it requires the user creating/importing a cert to use with it.
At least the cert manager is quite intricate and they have a video (assuming the device has a valid WAN IP) on how to set it up with letsencrypt.
---
Only a few of the barriers presented by HTTPS:
Clock sync would be a requirement for access.
A recent device would be a requirement for access (not everyone can afford a new one).
Site admin keeping up with certificate registration would be a requirement.
Approval from the centralized certificate authority would be a requirement.
Server's self domain name matching accessed domain name would be a requirement.
These are all real scenarios where real people can be denied access to information that is crucial to them, up to the point of survival.
Just a few of the reasons why all my websites still allow HTTP.
HTTP is also way faster on slow connections.
---
If you have Internet access, NTP trivially gives you this.
> A recent device would be a requirement for access (not everyone can afford a new one).
That's literally the point I addressed in the comment you replied to. Computers that are over 20 years old are still capable of connecting to websites using modern TLS.
> Site admin keeping up with certificate registration would be a requirement.
No, ever since ACME came out, certificate renewal can trivially be fully automated, with zero admin work required when one is about to expire.
> Approval from the centralized certificate authority would be a requirement.
Which is trivially granted as long as you actually own the domain you're trying to get the certificate for.
> Server's self domain name matching accessed domain name would be a requirement.
You can get multiple certificates and have the server use SNI to send every client the right one, or get one certificate with a bunch of domain names.
> These are all real scenarios where real people can be denied access to information that is crucial to them, up to the point of survival.
This is like saying that it's dangerous to go outside because there have been real cases of people being killed by meteorites.
This is not always true, and the user is not always at liberty to change the clock settings on their device.
> That's literally the point I addressed in the comment you replied to. Computers that are over 20 years old are still capable of connecting to websites using modern TLS.
This is just not true. I do a lot of testing, and there are many devices as young as 5 years that cannot access some websites due to TLS incompatibilities. I have a very nice device that's 10 years old which I use daily that experiences this on a regular basis.
> No, ever since ACME came out, certificate renewal can trivially be fully automated, with zero admin work required when one is about to expire.
Automation breaks, and certificates expire. I encounter websites with broken certificates almost daily.
> Which is trivially granted as long as you actually own the domain you're trying to get the certificate for.
It is not trivial at all. It requires a lot of administrative work, and many people around the world do not have access to this process at all.
> This is like saying that it's dangerous to go outside because there have been real cases of people being killed by meteorites.
No, it is like saying there are people out there who want to access information on the device they have access to, and we should enable them to access that information as much as possible.
Can you name the specific models?
> Automation breaks, and certificates expire. I encounter websites with broken certificates almost daily.
How many times have you seen that where the expired certificate came from Let's Encrypt? I'm guessing never, and that when you've seen it, it's always been from legacy ones without any automation in use.
> It is not trivial at all. It requires a lot of administrative work, and many people around the world do not have access to this process at all.
It only takes a few minutes to set up. Who has the required resources to own a domain but not to use Let's Encrypt?
I fail to find any;
As I mentioned in other comments, there are many possible areas where HTTPS can present a barrier to a user's access to your resource. Some of these I listed in another comment, which I copy below:
---
Only a few of the barriers presented by HTTPS:
Clock sync would be a requirement for access.
A recent device would be a requirement for access (not everyone can afford a new one).
Site admin keeping up with certificate registration would be a requirement.
Approval from the centralized certificate authority would be a requirement.
Server's self domain name matching accessed domain name would be a requirement.
These are all real scenarios where real people can be denied access to information that is crucial to them, up to the point of survival.
Just a few of the reasons why all my websites still allow HTTP.
HTTP is also way faster on slow connections.
---
this does happen
If the law forbids ISPs to show ads or modify the content in any way, then they won't do it.
Why that statement, because any law to ban ISPs from doing this will be met with millions in political investment by said ISPs to prevent it. Since the average person doesn't care about this issue it's a losing proposition.
Here's an example: a person goes to say Reddit, and clicks on a HTTP link about a new recipe. It's possible for a link to a malicious site being injected in the page. These were pretty common in developing countries.
Why do you think "handling user data" is the only reason to employ encryption? What if the website is serving up static content that seems completely fine to you or I but the user is in a legal situation where they would be in trouble for reading it? What if the user is somebody the local police are trying to frame, so the request was normal, the response was normal, but the response was replaced with something illegal so the police can arrest for possession? Why should every router on the path be able to see what I'm reading, what I'm reading web pages about medical conditions? Why do you insist that everyone should collectively make technical decisions that serve to enable this kind of thing?
This isn't hypothetical. A country once used their position of owning the local telecom to inject javascript into web pages that would DDoS another website they didn't like. See https://en.wikipedia.org/wiki/Great_Cannon .
The web moved from HTTP-over-TCP to HTTP-over-TLS because it fixes real problems. One of the common mistakes people make when thinking about security is trying to imagine the attacks themselves and then only defending against those. Your imagination is not the limit, you're up against the collective creativity of everyone else. Encrypt your stuff and remove a whole category of possible problems.
I am pro-HTTP for these use cases for as long as browsers have more serious warnings against self signed certs, old SSL/TLS versions and weak algo choices than the warnings for HTTP.
Hardware deserves to be supported as long as it physically works rather than as long as its embedded TLS stays supported
Of course. All traffic needs to be encrypted. Why must these not be encrypted?
> I am pro-HTTP for these use cases for as long as browsers have more serious warnings against self signed certs, old SSL/TLS versions and weak algo choices than the warnings for HTTP.
IMO, HTTP-over-TCP support should have been removed from all browsers years ago, solving your self-cert vs HTTP problem.
Good solutions for the LAN use case have been rather weak so far. The two categories of solutions are a) a CA for your LAN. People are OK using this for things like dev servers on localhost, but what you want is to have router that issues DHCP leases also issue IP certs for local devices. b) TLS-TOFU for self-certs. We can even do this over the public web too, but we can also treat self-signed certs on LAN vs. public web differently and report when the identity behind the IP has changed. (Generally a bad idea over the public web because we want to allow key rotation, but that might be fixable by adding multiple keys or some hack like publishing the next key into .well-known/next-key or something -- I'm riffing here.)
> Hardware deserves to be supported as long as it physically works rather than as long as its embedded TLS stays supported
Why? Or put differently, if the manufacturer has stopped providing firmware updates, they've unsupported it no matter what the rest of the world has done. Why should the rest of the world compromise security by design in order to only partially not-break a hardware device that the manufacturer doesn't support? In this one exact scenario? Maybe in the future we can provide a small ethernet-to-ethernet (or wifi-to-wifi) device that wraps a single old TLS device and provides a modern interface to it, if support is that important.
Until I hear a convincing story of how I will do the usual lan tasks of
- connect to my router to fiddle with settings
- see the management interface on my printer
- join my parents network and do things for them without having to explicitly trust a CA
- And most importantly, see consumers who don't understand any of those things be able to do these things all out of the box
I can't see how it is a viable expectation
I totally love encryption. It's great. But seriously: what domain will I visit to fix my pppoe settings. Who's going to control that domain, and who's going to renew the certs for it. Because if the answer we will expect consumers and SMEs to trust a certificate authority created by a factory with its own crappy security practices, I'm not sure how that's an improvement
Otherwise we are breaking things to "fix" something that doesn't "fix" anything. if someone is MITMing my lan, it doesn't matter whether my router is TLS or not. it's compromised
Big companies and governmental branches have their own root certificates.
To remove HTTP is the biggest mistake humans have made with the internet so far.
But it will trigger a reaction that deprecates both companies and governments:
Edit: Loving the down vote without comment and now the whole submission is flagged.
Google really does not want HTTP around. They seem threatened by it?
https://groups.google.com/a/mozilla.org/g/dev-security-polic...
25W Atom 14nm CPU is the best middle ground between 80W Xeon and 15W Jetson Nano. It is what you need to load balance saturation of 1Gb/s = Final decentralized node.
StarCraft might be playable, StarCraft 2 however will be a privilege.
Get your facts straight!
I'm talking about the future, not now.
Please link to the Atom benchmarks that show how slow they are on relevant server tasks. I remind you I'm talking about 14nm with 8-16 cores.
The burden of proof is on the people who make the (ridiculous) claims.
We had $1/KWh in EU this winter.
With that price you are paying almost $1 per day of running your 65W computer.
That's $30 per month just to keep the computer on during daytime.
There is no roof for how high prices or inflation can go.
Other gear are more important than entertainment, people will not consume games when they are hungry or cold.
I'm going to go out on a limb here and say that nuclear is heating the planet more than CO2, the efficiency of nuclear is 35% so for every KWh of electricity you heat the planet with 3 KWh.
3KWh that the planet has to radiate into space that did not get added during any time before.
We are slowly boiling the planet, like frogs in a casserole.
No it is not, especially in the context of running home computers. Why do you think that?
money is infinite
No it is not.
We had $1/KWh in EU this winter.
Average price is about 0.22 Here is some actual information.
https://ec.europa.eu/eurostat/statistics-explained/index.php...
That's $30 per month just to keep the computer gaming during daytime.
No it is not. 65W is the max amount of power. 10 hours a day every day at max is still a little over $4 per month. TVs, refrigerators electric heating and air conditioning are all 20x the impact of an average computer.
I'm going to go out on a limb here and say that nuclear is heating the planet more than CO2
You should not go out on a limb for anything. You should read and stop guessing.
Where are you getting your ideas? Source something, link anything that supports what you are saying.
They tell us to worry about man-in-the-middle attacks that might modify content, but fail to mention that they can do it in the browser, even if you use a "secure" protocol. They are the one entity you must trust above all. No way around it.
HTTPS is not only about "asking user for data" It is also: - preventing third party from spying on you - preventing third party from altering the content presented to the user
Yes, yes, 20 years old websites do not have https Is running a 20 years old software a good idea, on the internet ? Of course not
What is the point of this post ? I read the "why google really wants you to use https" and failed to find any sense in this
Is this meaningless ?