5 ms·

As a side note, news.ycombinator.com should really have HTTPS access. Passwords and cookies in clear HTTP are no good. Anyone here (should) knows it. Firesheep

As a side note, news.ycombinator.com should really have HTTPS access. Passwords and cookies in clear HTTP are no good. Anyone here (should) knows it. Firesheep proves it. GMail and Zuckerberg suffered it. Just buy or get a free SSL certificate, and let nginx or stunnel handles SSL and proxies HTTP to/from Arc. Total cost, being pessimistic: 150$ for the certificate verification, and 2 hours to set-up the certs & nginx. I know, it's awesome, it's a custom Arc webserver and all, and good practices are for PHBs only, but still. For a "hacker" website, news.ycombinator.com is a shame regarding to privacy/security (see also: passwords stored as shasums (without even a salt), funny things like <img src="http://news.ycombinator.com/logout> http://news.ycombinator.com/logout>, outdated versions of software used [http://news.ycombinator.com/item?id=516122 http://news.ycombinator.com/item?id=516122], etc.)

there 16y ago
i'm sure the audience of this site is technically savvy enough to all be running modern browsers that recognize startcom as a valid CA (if not, consider it a valid barrier to entry), so it would be free and take just a few hours to receive an SSL certificate for this site. http://www.startssl.com/?app=1 http://www.startssl.com/?app=1
- illumin8 16y ago
  Although I agree that having free SSL certificates is nice, I question whether it's actually a viable way to certify the authenticity of a site. Seriously, if you make it free, spammers will overrun it. Why should we trust free SSL certs? I think having a cost provides a certain barrier to entry that is good overall.
  - deleted 16y ago
    [deleted]
  - dmm 16y ago
    StartSSL requires you to respond to an email sent to the address listed in the domain registration. That at least shows you have control of the domain. It also has certificates with greater levels of verification.
  - apotheon 16y ago
    How does some corporation that will disclaim liability at the first sign of a light breeze telling you a site is "authentic" trump your own personal judgment? CAs are scams. Use something like Perspectives instead of CAs: http://www.techrepublic.com/blog/security/perspectives-better-than-cas/571 http://www.techrepublic.com/blog/security/perspectives-bette...
  - jackowayed 16y ago
    We don't need SSL certificates for authentication. I know that when I go to news.ycombinator.com, I'm getting Hacker News. We need SSL certificates for encryption. With the certificate you get a private key that is used for secure communication between your browser and HN (both ways). If it didn't cause every browser to show a big, scary, your-computer-will-instantly-explode-and-your-children's-social-security-numbers-will-be-stolen-if-you-continue, using self-signed certificates (ie. certificates that anyone can just generate) wouldn't be that big of a deal. It could open you up to a man-in-the-middle attack, but it's still way better than sending everything in the clear.
    - MichaelGG 16y ago
      > I know that when I go to news.ycombinator.com, I'm getting Hacker News. How do you know that? That's the whole point of SSL - knowing that you've traded private keys with the right party. SSL for "encryption only" only works to defend against attackers that can listen to your network, but cannot write to it. So, sure, it defends against some passive collection system, and perhaps against some tools that are designed to just listen. But, if browsers stopped displaying warnings, so that using a "bad" certificate worked just fine, then I'd bet the tools would just switch to allow cert injection and we'd all be worse off.
      - gergles 16y ago
        No, the point of SSL is encryption. SSH seems to handle key exchange just fine. (Hint: https should have been implemented the same way. CAs are fundamentally broken.)
        kgo 16y ago
        No, SSH does not. Have you ever actually verified a host fingerprint? Of course not, no one does. That's the way it's supposed to work. You know the first time you logon to a server and it asks if you trust it? You're supposed to call up the server admin and get them to read off the fingerprint, or have them email it to you, or get it from some other out-of-band channel. And no-one, nowhere actually verifies host fingerprints. Even security conscious people. And what do people do when they get that warning about a modified fingerprint? Just delete the entry from authorized_hosts and re-connect. So ssh actually does a really shitty job handling key exchange. Anyway, the closest thing to a real alternative to https and CAs is monkeysphere (OpenPGP WoT for servers), but no-one uses that.
  - dspeyer 16y ago
    Being able to pay isn't a very good barrier. Being broke doesn't mean having no meaningful content, and most attackers who can make serious MitM attacks can pay. CAs are supposed to have real barriers (and I think most of them do). In this case, though, we don't need a CA. PG could publish the key in an essay and we'd just carry it through manually.
    - jimrandomh 16y ago
      The point of collecting payment for certificates is not that attackers can't afford it, but that it enables the CA to do some cursory verification, and creates a trail of evidence if the certificate is used for a scam later.
ericb 16y ago
Here is a link to the relevant feature request (although it is a sin to call this a feature) in the feature requests thread: http://news.ycombinator.com/item?id=499851 http://news.ycombinator.com/item?id=499851
tptacek 16y ago
All HN needs is a note above the password field saying "don't use an important password". Nobody should care.
- requinot59 16y ago
  That doesn't protect from cookie/password steal (for instance if you use a public Wifi hotspot). I do care about identity usurpation.
  - tptacek 16y ago
    You shouldn't. There are more important things to care about.
    - requinot59 16y ago
      Like what, in the HN context?
      - tptacek 16y ago
        Declining quality of comments? Creeping influence of politics? SSL is a giant waste of time for Hacker News, modulo the fact that people might be crazy enough to use a shared password here.
        requinot59 16y ago
        > Declining quality of comments? Creeping influence of politics? It's a fallacious argument in my book. Like comparing apples and oranges. Say I run a bakery. What I care the most about is the quality of my bread. So much, I spend all my time working on that and only that. So much, I didn't ever bother to have a lock at the door. But it's not even a big deal if someone comes in and poisons one of the bread, as long as the overall quality is increasing! > SSL is a giant waste of time for Hacker News Yes, if by "giant" you mean that it takes like 2 hours to set-up, and a small payload for each negociation. But concerning the payload, Arc is not especially fast, so there is room for improvements there to compensate, if needed. > modulo the fact that people might be crazy enough to use a shared password here. Not the point, the point is HTTP sniffing. And anyway, people could use a shared password, making it easier for them (don't overestimate human memory), if HN used (HTTPS and) a "real" password encryption scheme (bcrypt or the like). Why put the burden on the user when you can put it on the computer?

there 16y ago

i'm sure the audience of this site is technically savvy enough to all be running modern browsers that recognize startcom as a valid CA (if not, consider it a valid barrier to entry), so it would be free and take just a few hours to receive an SSL certificate for this site. http://www.startssl.com/?app=1 http://www.startssl.com/?app=1

illumin8 16y ago
Although I agree that having free SSL certificates is nice, I question whether it's actually a viable way to certify the authenticity of a site. Seriously, if you make it free, spammers will overrun it. Why should we trust free SSL certs? I think having a cost provides a certain barrier to entry that is good overall.
- deleted 16y ago
  [deleted]
- dmm 16y ago
  StartSSL requires you to respond to an email sent to the address listed in the domain registration. That at least shows you have control of the domain. It also has certificates with greater levels of verification.
- apotheon 16y ago
  How does some corporation that will disclaim liability at the first sign of a light breeze telling you a site is "authentic" trump your own personal judgment? CAs are scams. Use something like Perspectives instead of CAs: http://www.techrepublic.com/blog/security/perspectives-better-than-cas/571 http://www.techrepublic.com/blog/security/perspectives-bette...
- jackowayed 16y ago
  We don't need SSL certificates for authentication. I know that when I go to news.ycombinator.com, I'm getting Hacker News. We need SSL certificates for encryption. With the certificate you get a private key that is used for secure communication between your browser and HN (both ways). If it didn't cause every browser to show a big, scary, your-computer-will-instantly-explode-and-your-children's-social-security-numbers-will-be-stolen-if-you-continue, using self-signed certificates (ie. certificates that anyone can just generate) wouldn't be that big of a deal. It could open you up to a man-in-the-middle attack, but it's still way better than sending everything in the clear.
  - MichaelGG 16y ago
    > I know that when I go to news.ycombinator.com, I'm getting Hacker News. How do you know that? That's the whole point of SSL - knowing that you've traded private keys with the right party. SSL for "encryption only" only works to defend against attackers that can listen to your network, but cannot write to it. So, sure, it defends against some passive collection system, and perhaps against some tools that are designed to just listen. But, if browsers stopped displaying warnings, so that using a "bad" certificate worked just fine, then I'd bet the tools would just switch to allow cert injection and we'd all be worse off.
    - gergles 16y ago
      No, the point of SSL is encryption. SSH seems to handle key exchange just fine. (Hint: https should have been implemented the same way. CAs are fundamentally broken.)
      - kgo 16y ago
        No, SSH does not. Have you ever actually verified a host fingerprint? Of course not, no one does. That's the way it's supposed to work. You know the first time you logon to a server and it asks if you trust it? You're supposed to call up the server admin and get them to read off the fingerprint, or have them email it to you, or get it from some other out-of-band channel. And no-one, nowhere actually verifies host fingerprints. Even security conscious people. And what do people do when they get that warning about a modified fingerprint? Just delete the entry from authorized_hosts and re-connect. So ssh actually does a really shitty job handling key exchange. Anyway, the closest thing to a real alternative to https and CAs is monkeysphere (OpenPGP WoT for servers), but no-one uses that.
- dspeyer 16y ago
  Being able to pay isn't a very good barrier. Being broke doesn't mean having no meaningful content, and most attackers who can make serious MitM attacks can pay. CAs are supposed to have real barriers (and I think most of them do). In this case, though, we don't need a CA. PG could publish the key in an essay and we'd just carry it through manually.
  - jimrandomh 16y ago
    The point of collecting payment for certificates is not that attackers can't afford it, but that it enables the CA to do some cursory verification, and creates a trail of evidence if the certificate is used for a scam later.

ericb 16y ago

Here is a link to the relevant feature request (although it is a sin to call this a feature) in the feature requests thread: http://news.ycombinator.com/item?id=499851 http://news.ycombinator.com/item?id=499851

tptacek 16y ago

All HN needs is a note above the password field saying "don't use an important password". Nobody should care.

requinot59 16y ago
That doesn't protect from cookie/password steal (for instance if you use a public Wifi hotspot). I do care about identity usurpation.
- tptacek 16y ago
  You shouldn't. There are more important things to care about.
  - requinot59 16y ago
    Like what, in the HN context?
    - tptacek 16y ago
      Declining quality of comments? Creeping influence of politics? SSL is a giant waste of time for Hacker News, modulo the fact that people might be crazy enough to use a shared password here.
      - requinot59 16y ago
        > Declining quality of comments? Creeping influence of politics? It's a fallacious argument in my book. Like comparing apples and oranges. Say I run a bakery. What I care the most about is the quality of my bread. So much, I spend all my time working on that and only that. So much, I didn't ever bother to have a lock at the door. But it's not even a big deal if someone comes in and poisons one of the bread, as long as the overall quality is increasing! > SSL is a giant waste of time for Hacker News Yes, if by "giant" you mean that it takes like 2 hours to set-up, and a small payload for each negociation. But concerning the payload, Arc is not especially fast, so there is room for improvements there to compensate, if needed. > modulo the fact that people might be crazy enough to use a shared password here. Not the point, the point is HTTP sniffing. And anyway, people could use a shared password, making it easier for them (don't overestimate human memory), if HN used (HTTPS and) a "real" password encryption scheme (bcrypt or the like). Why put the burden on the user when you can put it on the computer?