HN now comes with HTTPS?

https://news.ycombinator.com/

by mike-cardwell • 15 years ago

197 78 15 years ago

news.ycombinator.com

The Firefox addon HTTPS Finder just alerted me to the fact that there was an HTTPS version of the site at https://news.ycombinator.com/ - I tried it out, and it worked. Nice work.

EDIT: Session cookie needs to be set as "secure" and Strict-Transport-Security should be implemented in order to protect against certain attacks. End users can just add this HTTPS-Everywhere ruleset:

https://raw.github.com/mikecardwell/https-everywhere/73241d1...

profquail• 15 years ago

Thanks for the HTTPS-Everywhere ruleset!

I've been using HTTPS-Everywhere for a reasonably long time now (a couple of years?) but this is actually the first time I've added a rule...so if anyone else falls into that boat: all you need to do is save the YCombinator.xml file (linked above, from Mike's GitHub) into the HTTPSEverywhereUserRules folder in your Firefox profile folder, then restart Firefox.

Hopefully that'll save someone else from having to look it up ;)

NickBomb• 15 years ago

Thanks for saving me a minute or two. :)

EGreg• 15 years ago

Can you elaborate please? What is this "HTTPS everywhere" and why do we need it?

mtogo2• 15 years ago

A really fantastic firefox addon that forces HTTPS on certain sites. https://eff.org/https-everywhere/

walrus• 15 years ago

> and why do we need it?

If you're on an unsecured wireless network (e.g. at a library) and you don't want someone to see your HN password when you log in.

tobylane• 15 years ago

Here's a silent Chrome version https://chrome.google.com/webstore/detail/flcpelgcagfhfoegek...

wallflower• 15 years ago

Thank you, RTM and PG!!

k33n• 15 years ago

Seems like overkill to me.

46Bit5• 15 years ago

Ok, why shouldn't we use HTTPS? To me it seems silly that the vast majority of traffic isn't atall encrypted.

icebraining4• 15 years ago

Well, HTTPS adds latency due to its handshake, and of course it uses more CPU, especially on the server (unless a dedicated SSL offloaders is used).

pbreit• 15 years ago

It hides the referer which is unfortunate. Maybe an option only to login, register, etc via HTTPS?

dan_manges• 15 years ago

I was at a conference recently and saw somebody start Firesheep -- HN profiles showed up. So the choices were: use HN on open wifi but risk having your session stolen, don't use HN, or connect to a VPN. The VPN is probably the smartest thing to do on an open wifi network, but it's nice to know that HN is now safe to use without it.

_b8r0• 15 years ago

If you're going to a conference and you're using wifi there, please use a VPN. If you're going to a coffee shop and using wifi, if at all possible use a VPN.

By not using a VPN you're leaving yourself open to all manner of attacks (take for example the recent iOS SSL Cert validation issues as an example, but also consider the fact that an attacker could inject malicious content to attack your system over any HTTP traffic - or invalid HTTPS traffic if you make the connection).

At the very least you should use an SSH tunnel or some form of transport to protect all of your outbound traffic when in a hostile environment.

davepeck2• 15 years ago

I saw Firesheep in active use at the TechCrunch Disrupt NYC hackathon earlier this year. Yikes. No solution is perfect, but VPNs seem like the way to go for now.

[Shameless Plug] I quit my day job earlier this year and started building https://www.getcloak.com/ with two friends. We're caffeine addicts who dog-food our product; that's why we work out of coffee shops here in Seattle. (You can find our office by following @seafreemob on Twitter. ;-)

brackin• 15 years ago

This is great, thanks PG! Only problem for me is that the theme i'm running will no longer work but that's okay, i'm sure they'll update.

davezatch• 15 years ago

Not sure what kind of theme you're using, but it broke the Greasemonkey script Hacker News OnePage for me. If you're using something like greasemonkey or stylish, you might have to go into the script and tell it to work on https, since the sites are whitelisted with only http. That should do it.

Joakal• 15 years ago

Nifty report of HN's HTTPS: https://www.ssllabs.com/ssldb/analyze.html?d=news.ycombinato... Grade C it seems

tptacek7• 15 years ago

These stupid grades kind of drive me nuts, but they really should disable SSL 2.0 and the export ciphers.

netik• 15 years ago

SSLab's grades are not stupid. They monitor how solid the SSL implementation is and what needs to be corrected to ensure higher security on the site.

Another useful tool is SSLScan, which for Hacker News shows that they are accepting of a very strange set of HTTPS cipher and MAC configurations.

SSLv2 should be turned off, as well as the majority of 40-bit and 56-bit ciphers. Their unusual preference of CAMELLIA-256-CBC is pretty amusing to me.

  Prefered Server Cipher(s):
    SSLv2  168 bits  DES-CBC3-MD5
    SSLv3  256 bits  DHE-RSA-AES256-SHA
    TLSv1  256 bits  DHE-RSA-AES256-SHA

Whaaaaat?

reemrevnivek• 15 years ago

It was Grade C a day ago. Today I see Grade A:

    Certificate ------ 100
    Protocol Support -  85
    Key Exchange -----  80
    Cipher Strength --  90

What's changed in the past 24 hours?

pieter2• 15 years ago

For some reason it's now impossible for me to connect over normal http:

    manila:pieter$ curl -I http://news.ycombinator.com
    curl: (52) Empty reply from server
    manila:pieter$ curl -I https://news.ycombinator.com
    HTTP/1.1 200 OK
    Date: Sun, 21 Aug 2011 15:09:27 GMT
    Content-Type: text/html; charset=utf-8
    Cache-Control: private

qjz2• 15 years ago

When a single IP address can support multiple virtual hosts, probing port 443 for an SSL version of a domain is naive and may trigger an intrusion detection system (IDS). Sure, you may get a response (and even the same content), but that's no guarantee that the domain you used is configured for SSL on the server. An IDS may flag the request as a potentially malicious probe and temporary block the IP address from accessing some resources. This can be extremely useful for blocking exploit attempts by drive-by bots that request by IP address alone. Of course, it would be strange to continue to allow access to the SSL resource as in your example, but maybe there's a reason for it (server admin has different goals than site admin, for example). Just one possible explanation. You might regain HTTP access if you stop hitting HTTPS for a while.

Edit: The CN in the cert is news.ycombinator.com, so it's unlikely my explanation is the cause (but still could be).

pieter2• 15 years ago

I only started using HTTPS after HTTP stopped working, so that's probably not it.

mike-cardwell10• 15 years ago

Is it "naive", or is it totally harmless? I've been using HTTPS Finder, which probes for HTTPS versions of websites for quite a while now, without any noticeable negative effects. I'm sure sites out their exist which have this IDS configuration that you describe, but none of the ones I've visited do. As for the positives, I can't remember how many HTTPS versions of sites that it's alerted me to, but it's a lot

yahelc• 15 years ago

So, now the HN effect will be less measurable, as traffic from HTTPS to HTTP doesn't pass a referrer.

(This just increases the incentive for sites to use HTTPS Everywhere, so they're not left out in the dark as to who is sending them traffic.)

deno• 15 years ago

As a side-effect HN has upgraded from HTTP 1.0 to HTTP 1.1.

st3fan2• 15 years ago

This is great. It would be even better if HN would use the Strict-Transport-Security header so that browser remember to prefer https instead of http for this site.

See http://blog.sidstamm.com/2010/08/http-strict-transport-secur...

tptacek7• 15 years ago

If they were taking credit card numbers, STS would be worth the trouble; otherwise, it's not something I'd recommend going out of your way for.

For non- HTTPS- nerds: STS resolves the problem where your first contact with a site is via (insecure) HTTP, and a MITM makes all subsequent contacts lie to you about whether HTTPS is available. Since we've lasted many years without even having HTTPS, I think we can all just look at the address bar carefully instead.

mike-cardwell10• 15 years ago

That is not the only problem it solves. You can go to https://news.ycombinator.com/, but if you visit any other non-https website at the same time, somebody can MITM that connection, and inject the following HTML into it:

  <img src="http://news.ycombinator.com/">

That will cause your browser to do a non-https request against news.ycombinator.com (unless STS is implemented), which in this particular case can leak the session cookie, because the session cookie hasn't had the "secure" flag set on it.

I'd say that it is worth going out of your way for. If you're implementing HTTPS, it is only slightly more effort to implement STS as well. And it's definitely worth adding the secure flag to the cookie as well.

st3fan2• 15 years ago

Funny. The 'trouble' is not more than adding a single header:

Strict-Transport-Security: max-age=604800

And that is it. Your browser now prefers to use https for your web site. That was really not that much trouble, was it?

Also, https is not just for banking. I like it when people cannot see what I am doing online. Whether that is online banking, doing a google search or writing a posting on hackernews.

MikeCapone• 15 years ago

Is it possible for HN to use Google's SPDY protocol for better performance?

grinich• 15 years ago

Is this even supported by Chrome yet?

bradly• 15 years ago

Yes. Many of Google's own sites like Gmail and Google Maps use SPDY in Chrome.

calpaterson• 15 years ago

I'd guess that for HN, protocol is not the bottleneck

charlieok• 15 years ago

Glad to see this trend. How about using https links in the RSS feeds, so that anyone coming in from their feedreader gets https by default?

jorde2• 15 years ago

Nice addition to HN. We also updated Chrome's Readable HN to work with HTTPS https://chrome.google.com/webstore/detail/jpnbjaechgbbpokepg... and if you would like to contribute https://github.com/jorde/readable-hn

pclark• 15 years ago

Why do people want https on Hacker News?

tlrobinson• 15 years ago

IMHO any site that has a login form should use HTTPS.

jmatt• 15 years ago

Yep. For further explanation:

http://codebutler.com/firesheep

nostromo• 15 years ago

A lot of people on HN will use the same log in information they use on other sites. Some even have their email in their profiles.

If someone logs in on a wifi hotspot, their password is easily visibile to others. And voilà, suddenly you have access to someone's email, facebook account, etc.

HN now comes with HTTPS?

Related Stories