United States wants HTTPS for all government sites, all the time

https://nakedsecurity.sophos.com/2020/06/23/united-states-wants-https-for-all-government-sites-all-the-time/

by el_duderino • 6 years ago

158 87 6 years ago

nakedsecurity.sophos.com

kevingadd• 6 years ago

Gonna be unfortunate when they find out they've made HTTPS illegal indirectly by banning encryption!

It really is amazing to see how often one part of the government will actively sabotage the goals of other agencies.

wesley_snipes• 6 years ago

Remember it's always one standard for the spooks and one standard for the unwashed plebs. They keep you safe so you should be grateful.

LinuxBender3• 6 years ago

I don't believe they are making encryption illegal. Rather, they would likely require any org doing TLS for them to provide lawful intercept, logging, audit and compliance. If a government org is managing their own network stack, then requiring TLS would be a non issue as they can provide their audit orgs with all the data they want, as they likely do today. From all the bills I have read, there is nothing that makes encryption illegal. They want the ability to access data from the servers after it has been decrypted. This includes a way to intercept what users perceive to be end-to-end encryption.

The only problem I have run into with various government orgs is the lack of knowledge around implementing intermediate certificates. They will often try to talk people into installing their certs rather than installing intermediate certs correctly. I always point them to testssl.sh [1]

[1] https://github.com/drwetter/testssl.sh

cryptoz2• 6 years ago

I am having trouble parsing your comment. What do you mean by,

I don't believe they are making encryption illegal....They want the ability to access data from the servers after it has been decrypted. This includes a way to intercept what users perceive to be end-to-end encryption.

This is contradictory, no? The data is not encrypted between 2 users if a 3rd user can read it. It sounds like every bill you read makes encryption illegal, by your own explanation of the bill? I just don't understand what you mean here.

Maybe it's my personal understanding of 'encryption'? If Alice encrypts a message to Bob, and also gives the keys to Eve, but doesn't tell Bob that Eve has the keys, then I do not personally consider that message encrypted at all. Do you? What about the bills?

A message encrypted with a key held by a potential attacker is not an encrypted message any more.

rezonant2• 6 years ago

What? No, GP is talking about EARN IT et al which would mandate backdoors in encryption tech

president3• 6 years ago

After observing the mountains of opposition to EARN IT on large tech sites like Reddit and HN, I am starting to believe the "banning encryption" meme was started by tech companies to cripple the bill even though the word "encryption" isn't mentioned anywhere in the bill text. Guessing they are not liking the fact that the bill would force sites to be liable for illegal user-submitted content on their websites:

"(3) MATTERS ADDRESSED.—The matters addressed by the recommended best practices developed and submitted by the Commission under paragraph (1) shall include—

(A) preventing, identifying, disrupting, and reporting child sexual exploitation;

(B) coordinating with non-profit organizations and other providers of interactive computer services to preserve, remove from view, and report child sexual exploitation;

(D) receiving and triaging reports of child sexual exploitation by users of interactive computer services, including self-reporting;

(E) implementing a standard rating and categorization system to identify the type and severity of child sexual abuse material;

(F) training and supporting content moderators who review child sexual exploitation content for the purposes of preventing and disrupting online child sexual exploitation;

(G) preparing and issuing transparency reports, including disclosures in terms of service, relating to identifying, categorizing, and reporting child sexual exploitation and efforts to prevent and disrupt online child sexual exploitation;

(H) coordinating with voluntary initiatives offered among and to providers of interactive computer services relating to identifying, categorizing, and reporting child sexual exploitation;

(I) employing age rating and age gating systems to reduce child sexual exploitation;

(J) offering parental control products that enable customers to limit the types of websites, social media platforms, and internet content that are accessible to children; and

(K) contractual and operational practices to ensure third parties, contractors, and affiliates comply with the best practices."

thephyber5• 6 years ago

From the EFF (a civil liberties organization, not a tech company) coverage:

We’ve explained how the EARN IT Act could be used to drastically undermine encryption. Although the bill doesn’t use the word “encryption” in its text, it gives government officials like Attorney General William Barr the power to compel online service providers to break encryption or be exposed to potentially crushing legal liability.
The bill also violates the Constitution’s protections for free speech and privacy. As Congress considers the EARN IT Act—which would require online platforms to comply with to-be-determined “best practices” in order to preserve certain protections from criminal and civil liability for user-generated content under Section 230 (47 U.S.C. § 230)—it’s important to highlight the bill’s First and Fourth Amendment problems.

[1] https://www.eff.org/deeplinks/2020/03/earn-it-act-violates-c...

clairity5• 6 years ago

even better would be to kick google (and microsoft to a lesser extent) out of any and all government services, including gmail, analytics, captcha, android, forms, js, fonts, apis, storage, etc. it maddens me to have to turn over sensitive data to google to get government services nowadays. they've crept into every dark corner and crevice of government.

the governments we have are already wanting to surveil us plenty, we don't need a shadow entity doing it too.

cheschire• 6 years ago

So you're advocating for the government to build these tools in-house then?

clairity5• 6 years ago

in some cases, yes.

in others, for them to procure from product companies rather than data companies.

austincheney4• 6 years ago

Government and the military should absolutely be encouraged to write their own in house tools. That would dramatically improve quality of service and simultaneously reduced government expenses.

chrisseaton• 6 years ago

I think the government trying to build these tools and services themselves, or trying to procure them from a traditional government services company, would be an absolute disaster and colossal waste of money and time. No thanks.

0xffff26• 6 years ago

AFAIK, my corner of the government doesn't use Google or Microsoft services for any public-facing services. That said, we do use Google and MS (and AWS and GitHub and ...) internally, but with a huge caveat. Absolutely all of those services run exclusively on government infrastructure. None of the data hosted there is in any way shared or accessible to the companies providing the software.

clairity5• 6 years ago

awesome! please convince your colleagues to do the same. maybe it will trickle down to california, and LA in particular, where gov is love-nuzzling with google.

thephyber5• 6 years ago

You are really just complaining about the security model that the browser has chosen. When you visit a website, you choose to trust the content the owner sends back and all of the transitive trust that the owner embodies by importing images, scripts, styles, frames, forms, and hyperlinks.

And to the extent you are talking about how government works (online or offline), they manage to choose some terrible vendors. You don't get to opt out of those offline vendors, so what's the point of complaining about just a few online ones?

clairity5• 6 years ago

"You are really just complaining about the security model that the browser has chosen."

no, i'm not. everything we do is intimately tied together with huge slatherings of trust, browsing included. it's how societies and civilizations fundamentally work.

however, some entities like google have proven themselves less trustworthy. so let's move up the vendor ladder of trustworthiness, rather than staying stuck at the bottom.

"...so what's the point of complaining about just a few online ones?"

with that kind of defeatism, what's the point of anything?

every improvement helps, particularly when it involves one of the, if not the, largest privacy-invading, data harvesting machines on the planet.

robador• 6 years ago

This reads like an article of 5 years ago... Did time stand still?

cryptoz2• 6 years ago

In the US Government, for almost all of the last 5 years, there has been a concerted effort to move backwards, not to stand still or move forwards.

bigbob2• 6 years ago

Just 5 years?

pkage• 6 years ago

From my experience as a US government-adjacent worker, there are a few agencies that are really working hard to drag the govt into the present. The General Service Administration's digital efforts (login.gov, Digital Strategy, etc.) are fighting inertia to try to modernize the gov't. Additionally, the public research being done at NASA/NIH/other labs requires a lot of infrastructure—and that's spilling over into other labs and agencies.

However, it's all fighting the insane bureaucratic system that requires mountains of paperwork to do anything, as well as requirements to contract out jobs to expensive and shitty contractors.

partiallypro• 6 years ago

This has nothing to do with any administration, governments move slow. They have a lot of internal special interests (and I'm not talking about contractors) that fight to keep the status quo, largely because change can lead to people's jobs becoming irrelevant, etc. Then there are heaps of channels and regulations you have to go through to get anything done, even if you are an independent agency. Anyone that has worked in a large corporation or government knows how it works. The bigger is it is, the harder it is to implement change...even if it is the most basic change imaginable. This is one reason I currently would rather work for smaller companies where my voice can be heard and changes are more agile. Granted if a big tech giant like Microsoft offered me a job, I wouldn't decline...but some other corporations/government, especially old media companies, are like trying to roll a boulder up a muddy hill in terms of getting anything done; and I'd want nothing to do with it.

janderson3• 6 years ago

I have some friends in the employ of the federal government, who was raised Catholic. One time we were having a conversation that started about the Catholic church. He said is that some of the decisions of the Catholics are odd and slow because they are making decisions on the scale of a hundred years. They intend to be around by then.

The USA Feds seem to be on a similar plan, but it's more like a 10 year lag, and it finally seems to them like this HTTPS thing isn't just a fad.

Funnily enough the official website for the Holy See is also not HTTPS encrypted. (http://www.vatican.va)

themodelplumber• 6 years ago

This is a really good point. Organizations that play a stabilization role tend to benefit from this kind of dampened response to the various proddings of rapidly evolving tech.

beojan• 6 years ago

Funnily enough the official website for the Holy See is also not HTTPS encrypted. (http://www.vatican.va)

So that turns out to be a funny misconfiguration. https://www.vatican.va/content/vatican/en.html works perfectly fine, but https://www.vatican.va redirects to http://www.vatican.va/content/vatican/it.html.

tcberry2• 6 years ago

I would love it if DoD/VA sites would stop using wonky certificate settings all the time.

boris-ning-usds3• 6 years ago

Hi, this is Boris Ning from United States Digital Service.

Can you go into specifics of the "wonky certificate settings"? I can probably help you out with that or at least bring it to the attention of the team here at VA.

Donald• 6 years ago

They're likely referring to different parts of the federal government maintaining separate PKI. For example, the DoD has separate certificate structure (https://public.cyber.mil/pki-pke/) and these certificates aren't commonly pre-installed on platforms used by US citizens.

Fiveplus• 6 years ago

Relevant story from 2 days ago. Direct Link: https://home.dotgov.gov/management/preloading/dotgovhttps/

Posted here: https://news.ycombinator.com/item?id=23609538

jlgaddis• 6 years ago

... with zero discussion.

pbhjpbhj2• 6 years ago

How could they not have https, is that by decision, or by incompetence, or...?

HenryKissinger• 6 years ago

Every change has to go through months, or years, of review, and be approved by 50 different people.

I take it you've never worked for the government, have you?

hirundo• 6 years ago

Only until around April 16th.

https://en.wikipedia.org/wiki/Tax_Freedom_Day

pbhjpbhj2• 6 years ago

So the site devs fixed it 5 years ago and we've been waiting for management to sign off "should we implement basic site security"?

Heads should roll, really.

kache_• 6 years ago

Not everything needs https.

You can read more about this here: http://n-gate.com/software/2017/ (Discourse on https)

kobalsky• 6 years ago

>> If people don't want to see my site with random trash inserted into it, they can choose not to access it through broken and/or compromised networks.

Such a pointless read.

onlyrealcuzzo• 6 years ago

Isn't congress actively working to limit encryption for everyone else at the same time?

KeepFlying3• 6 years ago

If I understand things like EARNIT correctly, they want to limit end-to-end encryption. I don't think they have a problem with HTTPS or any of the other transport encryption schemes.

I know its a bit of a nitpick, but its important that they know we understand the laws they want to push through and STILL disagree with them.

bargl2• 6 years ago

The US government probably has more software than any non-tech company out there.

Non-tech being very important here. The US government is not a technology company. So think of the worst enterprise software you've seen and the US government has it beat somewhere on some system they are still using.

How does this happen? Contracts, they write contracts to the lowest bidder to build them software and then they pick the greenest/cheapest software engineers to do work in a mix of waterfall, agile, what's older than waterfall?

On top of that they've got mission critical software that runs on this stuff. A silly little change like upgrading paper Notices to Airmen (NOTAMs) requires YEARS of planning, safety analysis, and buy in from a representative every airport/airline/airtraffic controller across the US. Multiple unions etc.

At it's worst the us government is slower than the slowest enterprise company you've seen.

On top of all that, there is a review board for EVERY (mostly open source library you want to import, so there aren't bad actors on it. This review process is slow and pushes back on innovation. The worst thing you can do as a contractor is not hit your deadline. So many of them use tried and true technologies to get the job done, but don't innovate.

Is it by decision? Yes the decision to pick the cheapest contractors, yes by the decision to include security in a way that actually slows things down, yes by a myriad of decisions that make innovating government software really hard.

Is it by incompetence? Meh, yes and no. You have people even at these contracts who are railing and screaming against this. There is competence in all these places. But the pressure to slow down and do things a specific way push back so hard it's really difficult to accept new risk.

And this was just my experience on one contract. Another government contract was super innovative and fun.

bumby• 6 years ago

What’s the discriminator between the two vastly different contract experiences? Is it contact size, bureaucracy, visibility, mission-criticality...?

gpvos• 6 years ago

Inertia, forgetfulness, lack of decision. Which can be construed as incompetence if it goes on for too long. If it's for a website that started within the last three years, it's direct incompetence.

thephyber5• 6 years ago

Government policies. Legacy code. Cascade of updating vendor contracts and waiting for them to update their product/service. The Webmaster frequently doesn't have the autonomy to be able to prioritize the project they think is most critical.

The switch from HTTP to HTTPS is almost never as simple as "call LetsEncrypt and switch the port number". If you have an existing HTTP site that includes Images, Script, Styles, Frames from other HTTP resources, switching the top of the page to HTTPS may break functionality on the page if the browser's security settings deny HTTP resources from being loaded on the newly HTTPS page.

That said, there's really no reason any government shouldn't prioritize these fixes... except we are in the middle of a COVID-pocalypse where budgets are likely to get slashed. Sometimes it's "incompetence" of management (not seeing the risk after it's described to them or their underlings not communicating the risk), but mostly

aequitas2• 6 years ago

Shameless plug: our team developed an open-source tool that helps organisations visualize security issues (like missing https) on a map so it is easy relatable for citizens (and government employees) if for example their municipality is doing a bad job and helps those citizens (and goverment organizations) improve their security.

It's free and easy to setup for your own country if you're interested: https://websecuritymap.org/

Example of the site running for the Netherlands: https://basisbeveiliging.nl/

mkranjec• 6 years ago

Thank you kind stranger. Looks promising.

rapnie• 6 years ago

Thanks, looks interesting.

PS. The .org site does not look well on FF/Android (texts clipped, etc.)

ThePowerOfFuet• 6 years ago

Also renders terribly in Safari on iOS 13.5.1.

aequitas2• 6 years ago

Thanks for the feedback, it's noted: https://gitlab.com/internet-cleanup-foundation/web-security-...

raybb• 6 years ago

This may be a silly question but do you know of any high profile incidents where not having https has been an issue?

I understand the risks but am curious if there have been some cases that are pushing https forward after they got publicity.

gentleman112• 6 years ago

Which is it - HTTPS for for everything, or ban it? Or is it that they think only they should be able to use it? https://news.ycombinator.com/item?id=23636487

austincheney4• 6 years ago

You are falsely assuming government agencies have a shared set of priorities in common agreement.

https://en.m.wikipedia.org/wiki/Reductio_ad_absurdum

nend• 6 years ago

You make it sound like the US government is one homogenous voice with one opinion. A republican senator introduced one bill that affects HTTPS, while a completely separate non-legislative government group is advocating for using HTTPS on the sites they control.

Which is it

It's both, there's two separate groups advocating for two separate things here.

happythomist2• 6 years ago

There's a pretty significant difference between "no HTTPS" and "mandatory decryption for consumer electronic devices with a warrant", even if the latter is still a bad policy.

gentleman112• 6 years ago

The author of the article (in the hn story) I linked claims that the legislation in question bans https

delecti• 6 years ago

The government being able to use HTTPS on their sites is not logically inconsistent with a requirement that the government be able to get through any encryption.

fhqghds2• 6 years ago

as someone who works on such things at a .gov, this has been in the works for years, and will likely remain in the works for years

the level of push back against it is absolutely epic.

the .gov I work on has even been considering moving most services off of .gov to another tld (such as .us) in order to avoid having to comply...

KeepFlying3• 6 years ago

What is the reasoning for the pushback? Can you talk about some of the reasons they give for that?

fhqghds2• 6 years ago

short answer: massive amounts of inertia

long answer: there are a lot of reasons...

one is that our network is obscenely open and used in weird ways.

public ips handed out to all the things via dhcp. dynamic hostnames (generated from the dhcp request) on a subdomain of our .gov for all the things. similarly static ips and top level dns records on our .gov are passed out like candy.

the border is heavily firewalled, and all networks are heavily sniffed and monitored, but everyone has a public ip with a .gov hostname. the network users consist of thousands of academics and scientists who use the network in fun an interesting ways, frequently without tls.

changing this culture is likely way more difficult than making config changes on bind and dhcpd

I've slowly learned to stop asking, and just try to keep my sobbing down during calls

annoyingnoob2• 6 years ago

United States wants HTTPS for all government sites, all the time

But they want to backdoor the encryption so that foreign governments can spy on those encrypted connections. Genius.

thephyber5• 6 years ago

To be fair, not all of the United States government wants to be on HTTPS (all that quickly) and not all of the government wants to backdoor encryption. I think it's important to point out that some of the US Government has a more tempered approach to the issue.

The NSA tends to ignore the domestic quibbles about encryption because they tend to have much more flexibility in how they work around encryption hurdles. The DOJ and local police departments scream bloody murder about encryption everytime there is one phone they can't access and a few congress Critters use that call as a political wedge issue.

annoyingnoob2• 6 years ago

Proponents of backdoors are beating the drum louder, harder, and more often as time goes on. They are playing the long game. It seriously concerns me that morons want to take us in the wrong direction.

stx• 6 years ago

I expect to see more government sites for which https is on but the cert is expired or does not validate.

eddietejeda• 6 years ago

Hi, I work on infrastructure in the federal government.

Here's my take: the title is unclear. The federal government has required https for a while.

Learn more here: https://https.cio.gov/

OMB wrote a memo requiring https in 2015: https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/me...

If you see the "announcement" linked in the article, you'll notice that it's referencing this page: https://home.dotgov.gov/, which is about the HSTS preload list.

United States wants HTTPS for all government sites, all the time

Related Stories