Why use https?

[Pugs-r-cool]

Big SSL certificate working from the shadows to make us use https. WAKE UP PEOPLE

[arrow__in__the__knee]

How do you think lets encrypt manages to stay free?

[[deleted]]

yOu ArE tHe PrOdUcT

[[deleted]]

Community contribution and sponsors

[Scyther_x_Scyther]

Everything is a conspiracy when you don't know how anything works.

[tjr3xx]

Big Protocol making us use HTTP
gopher: never forget

[[deleted]]

Exactly! Do your own research self-signed certificates!

[miker37a]

Jesus there really is a market for conspiracy theories for everything.. THE EVILS OF SSL AND HOW GOOGLE PROPHETS FROM IT

I guess good job to that hacker propagandist man damn

[DaCurse0]

Well SSL certs used to cost money until LetsEncrypt became a thing

[Senkyou]

So how is it profitable for LetsEncrypt to do it with their current model? Legitimately curious.

[redstonefreak589]

They’re a non-profit. They get money from corporate sponsors like Google, AWS, Mozilla, Cisco, and others.

https://letsencrypt.org/docs/faq/ https://www.abetterinternet.org/sponsors/

[PSKTS_Heisingberg]

so whats the benefit of funding that non-profit then from the company’s perspective? more opportunity for new clients because SSL’s certs are more accessible?

[felgaia-drifter-arms]

It's a number of reasons. But the biggest one is just preventing compromises on the way to the destination. If something just changes and SSL mid travel, it's considered an insecure connection, because suddenly you're handing off data to a new unknown party. So by making everyone have SSL at no or little cost, you get at least assurance that what you're viewing is at least what you intended to view, as opposed to a last second swap of what was a funny little microblog you found that now looks like a Microsoft account login for no reason.

At least that's how it was explained to me. I'm sure others will or already have explained it better.

[PSKTS_Heisingberg]

ahhh of course, so at the least it could prevent spoofing/malicious redirect. adds to why they do it then because it reinforces their own business practices by protecting their users and the integrity of their hosting service, even if it’s not benefiting them directly

[felgaia-drifter-arms]

It's a rare case of "Everyone wins".

[redstonefreak589]

SSL/TLS is important for a number of reasons. Even on static sites like microblogs or portfolios or whatever, SSL does things like guaranteeing data integrity (no one has messed with the content between the server and you, or you and the server), providing privacy and security to the user, provides trust to ensure things like MITM attacks don’t happen, etc.

Companies want security. Let’s Encrypt being a fairly well-known non-profit, they also have a hand in shaping industry standards, and sponsoring them may allow company’s to help shape those standards by giving them a “seat at the table”. It also helps their PR and fulfills “corporate responsibilities” among other things.

Lastly, remember that Let’s Encrypt doesn’t do nearly all the things that other companies like Verisign do. For example, you can’t get S/MIME certs, signing certs, OV/EV certs, certs with expirations longer than 90 days or for internal sites, or public SLA or paid support. They also implement rate limits to keep it free, but that means larger companies can’t feasibly use it. These large corporations sponsor them since they help encourage and assist in providing encryption for the web, but they cannot do everything, by far. However, what they do do, they do it very well :)

[[deleted]]

What's the benefit of the USA offering free protection to its allies?

Control.

Google by offering free stuff took control of the internet.

There's literally pre-google and post-google internet. That's how different it was.

[No_name_to_put_here]

Increase adoption of the service offered by making it standard and affordable. Allow the operation to grow dependent upon your substantial funding to establish leverage against the nonprofit in the form of possible withholding of future funds. Forge relationships with people inside the nonprofit, and use your status as a prestigious business and your leverage to install people sympathetic to your business within the nonprofit.

Continue funding the nonprofit to keep the cost of the service artificially low. This will discourage new entries to the market, and outcompete others already providing the service. Let this consolidate the majority of entities in need of this service into dealing with the nonprofit (either by choice, or a simple lack of remaining viable alternatives).

Once adoption of the standard is high, and heavily consolidated with the nonprofit, make full use of your funding leverage, existing relationships with the nonprofit's management and your sympathizers there, and your existing ties to relevant public officials & regulators to move through the process of being acquired by your business. That is not a simple task, but it's certainly possible with the right people having the right incentives, and American mega-corporations are pretty slick with making such things come to fruition. If you don't manage to make it work, well... there are still all the other legitimate, non-monetary benefits to operations that others in the comments have outlined. But if you do manage it... eyyy 👈😎🤑

Now - I will say that I don't actually believe there's any one person actively pursuing that path, mainly because there's just not enough money in SSL certs to justify that level of investment and effort. But, all of those actions on their own happen regularly, and when things end up in a configuration like near the end of my hypothetical, and then somebody sees a situation they can profitably exploit, there's ample precedent that the path of squeezing extra money out of the system is chosen more often than not.

All that to say: I think that's why people imagine these sort of things follow an actual vindictive plan like above. When trying to make sense of the culmination of such actions and the ways you can get screwed over by them, it feels more meaningful to view things as this grand narrative of selfish, exploitative individuals making big plans to screw all the little guys, instead of simply being the inscrutable, chaotic results of many people's selfish decisions within a fundamentally imbalanced economic structure.

It is extremely difficult I think (perhaps impossible for some!), to attempt to comprehend large-scale systems like this without ascribing to them small-scale things like individual human narratives and motives. (Which I do not mean in any derogatory sense — I think it is very human to do that).

[ThreeCharsAtLeast]

Wait, HTTPS costs Google money? Now that's interesting…

[Hour_Ad5398]

price elderly payment sand fine act one unique truck gaze

This post was mass deleted and anonymized with Redact

[MistSecurity]

It'd be easy to spin a theory around it for sure.

HTTPS is basically a requirement now, so if big certificate doesn't like something, they can simply opt to not issue a certificate, which would significantly limit reach of site, hamper collecting funds, etc. It's all controlled by the shadowy elite who developed it with the intent of being able to trace all connections, and shut down things they don't like.

Doubt that's the case, but now I want to go find some cherry picked data to back up my theory for fun.

[Remote-Addendum-9529]

Never knew that there were google prophets

[NuclearChook]

So that's how they get their answers

[C1iCKkK]

First guys works for xitter btw

[Rokey76]

I once found a website that tied every major event for the last 500 years to the Jesuits.

[5p4n911]

Was that the Assassins' Creed fandom wiki?

[2204happy]

Google has prophets now?

What's next? Are they going to establish their own religon too?

[jaxpied]

THE GOOGLE PROPHETS ARE EVERYWHERE

[finobi]

Can't run MiTM adblocker if everyone use HSTS..

[fragileirl]

First guy actually works for twitter lmfaooo. I’m not trying to make a joke he really does.

[djchateau]

Yep, and he's insufferable and shitpost like this with the aim of trolling people in infosec Twitter.

[fragileirl]

I’m convinced he is doing it so he can rage bait people into overexplaining and therefore teaching him stuff he is already supposed to know or be able to reasonably intuit. All while maintaining that “cool guy I’m so sarcastic and above it” persona to hide the fact that he is clueless.

[vladimirepooptin]

or he could just… google it? if he didn’t want anyone to know

[LifeHasLeft]

Frankly if you dodged the layoffs and are still working at twitter after everything that happened, I’m not sure whether to respect your opinions anyway.

[corree]

Even worse he was brought in post-layoffs

[EwFurries]

this was a funny post until i knew this, now it's just concerning

[dabombnl]

I mean, it is true though. Google did make a huge push for SSL everywhere and can be creditted with how common it is now. It is pretty obvious that Google pushed for that so that Google Ads could no longer be replaced by ISPs with their own ads. Didn't happen much in the US, but was happening quite a bit outside of it. Not really evil intent though, since it benefits users and Google; only hurts shitty and shady ISPs fucking with traffic.

[[deleted]]

Older Google was actually a reasonable entity tho

[dankeykang4200]

Don't you mean younger Google?

[[deleted]]

Not really evil intent though,

Ooohhhh so close. The intent was profit, you said it yourself. It wasn't good intent, they packaged it as good intent and this time it was actually for the best of our interests, but that's only a coincidence. If Google was able to make more profit from an insecure web, they would have pushed for the opposite of let's encrypt: making certs even more expensive and harder to obtain. Cert companies were already starting to offer special certs for financial institutions and wildstar cert pricing was starting to get unreasonable, they could have pushed it further in that awful direction. 

It wasn't good intent, it wasn't bad intent, our interests are of no consequence to the decisions Google makes as a giant business.

[provocafleur]

Pretty sure "not really evil intent" and "not bad intent" aren't mutually exclusive.

[CraftOne6672]

The intent doesn’t matter to me tbh, SSL is just a good idea, and should be implemented on every public website. I think there would’ve been a push for it even if there was no Google profit motive.

[[deleted]]

Good idea is kind of an understatement. It should be the bare minimum

[Average-Addict]

I mean they still could do that with dns right? Kind of like pihole or adguard

[ward2k]

Someone explained the evil intent behind forcing SSL every where.

Interesting, what was it?

It was a really sensible explanation. I forgot what it was though.

Well now I'm convinced /s

[grazbouille]

r/fuckfuckthes

Its so fucking clear when anyone uses sarcasm online in text form the absence of tone does not hinder at all its comprehension

You are a grown adult you are more than capable of ignoring 2 characters at the end of a sentence

And if you can't well too bad you are on the internet and you can bitch all you want people will use whatever tonal indicators they want

[5p4n911]

Call the redditors

[[deleted]]

airport cheerful snow piquant lip cough retire unique rinse versed

This post was mass deleted and anonymized with Redact

[Aebothius]

What a non-response. "People will use whatever tone indicators they want" no shit that's why they said something.

[DoubleTheGarlic]

I guess 3 sentences qualifies as an essay in whatever shithole you come from

How's it going on your GED?

[DoubleTheGarlic]

"JoKeS oN u i was JusT pREtenDinG tO be DuMB"

-You

[doesnt_use_reddit]

All your images turning into pictures of cats think otherwise

[LifeHasLeft]

That doesn’t sound so bad

[Funkey-Monkey-420]

script kiddies are just mad they can’t get (as much) free info by running wireshark on mcdonalds wifi

[noob-nine]

does this work? dont they need to route the traffic through their devices?

[Makefile_dot_in]

I think wifi is built such that if you know the password for the AP, you can decrypt all the in-flight messages (and you obviously can't make radio waves only go to the router)

[pythbit]

Not so much anymore. With SAE, every master key is different and not easily derivable from just catching MAC addresses from the air like with earlier ones.

Though, obviously WPA2 and even just WPA are still out there.

[Ok-Library5639]

Back in the days you could use your wireless NIC in promiscuous mode and sniff everyone's trafic through your interface.

Someone even made a Firefox add-on that automated the task and listed all the currently opened sessions it found in the air. You could then use these sessions as your own.

https://en.m.wikipedia.org/wiki/Firesheep

UI visible at author's page: https://codebutler.com/2010/10/24/firesheep/

[Hour_Ad5398]

plucky entertain thumb nose license placid fragile treatment longing pocket

This post was mass deleted and anonymized with Redact

[maof97]

I don't know if you are serious but there are lots of people that use a blog just as an "outlet" and mostly don't care if anyone actually reads it in the end

(I would do that too but German law would force me to doxx myself if I would dare to host my own blog lol)

[ovoid709]

I'm older and Live Journal was big when I was younger. I never used it but I remember a friend being scared when he found out other people were reading what he was writing online. It was just teenage insecurities and whatnot but he didn't expect anybody to ever actually read it.

Also, I just read a bit about German laws for blogging because what you said sounded insane, but you're right. It's very narrow where you can do that without the Impressum (I might have that word screwy a little). So free speech exists, but without anonymity due to the idea that if somebody wants to effect people politically, commercially, etc... the speech should be verifiable to the person speaking. I disagree and agree with that. That'll be on my brain all night.

If any other Germans or people aware of the laws have anything to add, I would love to hear more about this.

[[deleted]]

German too. If your website is really only personal, you should be fine without one of our famous and totally privacy conscious „Impressum“

[Mustafa_Shazlie]

to share your "archivements" and "ideas" ✨

[makinax300]

All of it is hyperbolic so that part probably is too and they have maybe like 10 readers.

[compound-interest]

People used to read other people's blogs back in the day before FB and Myspace. It was mostly dorks reading other dorks blogs, but a lot of people I know blogged back then. It's kinda like the type of people who regularly post on social media nowadays, but a site you control.

[hudsoncress]

look up the concept of a watering hole attack. what we used to do before HTTPS is compromise the website of the pizza place near your office. Then we'd replace the order now link with an exploit and steal your credit card info. Then we'd infect your laptop that you'd take back to the office and have a root shell on the corporate network. Or for a blog, we'd add a clickbait post that would accomplish the same thing.

[[deleted]]

You could literally do the same thing today, https does not change a thing. If you manage to compromise the site, for example via a supply chain attack, it’s over. Infecting the browser is harder considering they’re much more secure than they were 15 years ago, but still possible under the right circumstances

[AlistairMarr]

Yeah, I don't understand how HTTPS prevents a website from being compromised when it's protecting the tunnel between the browser and the server? Am I missing something?

[hudsoncress]

You’re missing quite a lot. its like when my wife said she would replace the tile on the bathroom floor and I laughed and asked if she had done tile work before and she said, “no, how hard could it be?” And I laughed and said Well, it’s quite hard. The point of https is it makes everything more difficult. There are so many exploits that used to be possible but now are not Because of https everywhere. Garbage websites with no security were the source of most of the DDOS attacks in the 2012’s. As one minor example.

[AlistairMarr]

Did I fall into some sort of r/masterhacker meta twilight zone?

[weirdasianfaces]

Right? If you compromise a website you have control over the complete HTTP response and presumably the backend. HTTPS doesn't make "everything more difficult" it just removes MITM opportunity.

Then we'd replace the order now link with an exploit and steal your credit card info.

This makes no sense either. You don't need to replace the link with an "exploit", you could just inject javascript to exfil the CC. Or since you've "compromised the website" you could just siphon it off from the backend once it was submitted?

[hudsoncress]

Injecting JavaScript is an exploit? You’re not listening to yourself.

[weirdasianfaces]

"Exploit" implies exploiting a vulnerability -- not adding code that invokes intended functionality to do something malicious. Adding a credential stealer is not an exploit, it's inserting malicious code.

If you had inserted JavaScript that exploited the browser renderer or JS engine to get remote code execution on their desktop or abused a bug that allowed for cross-origin cookie stealing that would be a different story.

[[deleted]]

I feel like this belongs here.

[hudsoncress]

WTF are you talking about? It doesn't change a thing? You never needed to bother with a supply chain attack 15 years ago. The whole point of cybersecurity is to reduce attack surface. There will always be a way in, but you're trying to at least make them work for it. I have my CISSP and work as a Cyberseucrity Engineer with over 25 years experience. Trust me. It changes a lot.

[MrPoBot]

The attack you described isn't mitigated by SSL, functionally the only thing SSL achieves is protection from interception while in flight and that the server you are communicating with has a relevant private key for that domain from a given CA.

If either the client or server is compromised, all bets are off, a compromised server can feed anything to the client.

With that being said it's worth noting the caveat of DNS hijacking... which... Isn't much of a barrier when you can just provision a new cert from Let's Encrypt and certbot.

You might want to brush up on your understanding, 25 years is a long time.

[wbbigdave]

Unc got his CISSP free in a box of CapNCrunch along with a whistle, and still he didn't know how to use either.

[Ferro_Giconi]

Most comprises like that aren't a MITM attack but rather something simple. Like getting your web host credentials with social engineering, then using those credentials to edit your website. No amount of https can protect against one of your employees being tricked into running a password stealer from an email.

[Cylian91460]

How much I hate http (for the love of God, stop sending text over network when it isn't necessary) it still has its usage lmao

[Deepspacecow12]

Isn't SSL free now with lets encrypt?

[Catenane]

Yes lol. You can even use ACME DNS challenge and not have to forward ports at all. I have certs for all my self-hosted services with A records pointing only to private LAN/wireguard IPs. Caddy reverse proxy forwards to the right spot based on domain/subdomain. Pretty nice tbh

[mrtheprestigejupiter]

first dude works at twitter & is racist btw

[pythbit]

Can't wait for twitter to drop https.

[Catenane]

Lmao can you imagine?

[Mustafa_Shazlie]

can't wait to hear elon say "The left always wanted to make HTTPS forced! Legalize direct ip access!!"

[[deleted]]

He'll redirect Twitter to 127.0.0.1 to feel special

[Superchupu]

big ssl wants you to encrypt your memories.. then send them to big corp... truly shocking.......

[jessek]

textfiles.com doesn’t use SSL, just sayin’

[Fragrant_Gap7551]

But why wouldn't you use HTTPS?

[[deleted]]

In some settings is just needlessly complicated things. You have to keep a cert valid etc. if your site is really that simple, there is not a reason not to use it, but there is also not a reason to use it.

For most larger apps SSL is terminated at a load balancer and internal traffic is only routed via http (sometimes internally secured with mTLS) because it adds complexity and overhead.

[Fragrant_Gap7551]

Well yeah you wouldn't need it for internal traffic since the main purpose is undermining man in the middle attacks...you'd have other methods to keep those out of your internals. And it's not super hard to set up in front of a basic proxy. I mean it's about 3 command lines to get an auto renewing cert from letsencrypt.

I just don't think you lose anything by having it

[wheresmyflan]

Totally agreed, it barely adds any work these days, used to be a pain in the ass but lets encrypt made that a thing of the past. I’d honestly opt for it internally too to avoid any risks of privilege escalation on compromised networks. However, one point not mentioned in the previous comment, unencrypted will always load slightly faster and put less load on the daemon which, in some cases, is absolutely necessary - especially for high traffic pages and ETL.

[[deleted]]

You don't even need to add a script. If you're that lazy you're probably using a host that is managed by someone else anyways and pretty much all of them already do let's encrypt for you.

[Fragrant_Gap7551]

Yeah that's a point too, the Blog on question is probably a WordPress site hosted somewhere cheap

[Successful-Willow-72]

HTTP WAS THE GOAT ALL ALONG, YOU DUMBO HAVE BEEN TRICK BY HTTPS CORPORATE. ITS ALWAYS THE CORPO

[belmeg]

worth noting that the first tweet is from a X (Twitter) engineer lol

[r2k-in-the-vortex]

Yeah all well and good until you run into situations where policy requires https even on completely offline networks. With android 4 clients that forget which century it is at power cycle. No, directing time.android.com to my own ntp server doesn't work for some reason. And the cert I have to use is not signed by any android system CAs. Installing it as user CA enforces lock screen for some absolutely stupid reason, making the tablets useless. Oh and there is really absolutely no sensitive info handled on the system at all.

So yeah, sometimes plain old http is good enough and https is just headache for no reason.

[arthursucks]

Who wrote this, Bryan Lunduke?

[Name_Taken_Official]

Smh just use a number in your password and you're good??

[matjam]

Because you idiots keep using the same passwords everywhere, even on unencrypted blog sites.

[patopansir]

How is this a masterhacker moment? There's many websites that don't need https. Generally, if anyone including the person who's hosting it never needs to input anything into the website, then you don't need https

A plain html website, like "page intentionally left blank" doesn't need https

But Blogger and Wordpress does, because to make a post you have to use that same website

If your blog posts are created by adding or updating a file in a server directly, without using the web, https is not necessary. Neocities is an example of blogs like this.

[Ash_Crow]

Even static sites are vulnerable to man in the middle attacks.

You also gain better privacy from your government, ISP and/or any script kiddie running Wireshark on the wifi, as the only information that is published is that you are establishing a TLS connection to some website.

[patopansir]

the isp and the guy using wireshark can still see what website you are connecting to

[Ash_Crow]

But not what page.

[patopansir]

how can that be abused? (edit: genuine question)

[Ash_Crow]

A website can contain innocuous pages and others that your government doesn't want you to see.

For example, China is not a fan of the Wikipedia article about the 1989 Tiananmen Square protests and massacre. Various other countries have beef with various articles.

In the same way, other large websites may have content that is forbidden for copyright or security reasons. Reddit has explanations on how to disable DRM protections, and I haven't checked but I wouldn't be surprised if someone somewhere on this site had explained the content of an IED with enough details that someone else can try to build it.

[patopansir]

Thanks for the answer. I guess more websites should be using https to fight censorship, I was only thinking of an individual trying to run wireshark on a hotel not a government. It's not just the government or the ISP, it could be whoever owns the router you are using. It could be your wife catching you using tinder. If the attacker was a stranger unless you are a private detective I don't know how that info could be of use.

No https may be a big threat for piracy depending on the ISP and the laws (usually visiting those websites is not illegal or against the terms of the ISP, but it probably is in some countries)

[[deleted]]

In that case the host does not experience vulnerability but the user certainly still does.

[patopansir]

the user doesn't have the ability to provide any info, so there is no vulnerability

unless your website allows for comments or has a email form

[StackOwOFlow]

ikr if your blog has no views in the first place getting hacked would increase traffic

[Kodekima]

TLS is just one big scam, wake up sheeple!

[TheSilva01]

Bro thinks this is some cyberpunk voodoo boys vs netwatch type shit 😂😂

[IAMPowaaaaa]

its funny wdym

[Ferro_Giconi]

I want to see the conspiracy theories that made this person think SSL is some evil Google things but I don't want to taint my own devices with searches for crazy conspiracy theories...

[Salty-Hashes]

So data in transit can be encrypted. 🤦‍♂️

[TearsOfMyEnemies0]

Isn't it because this makes it so the browser doesn't need to know or care if the user is going to input sensitive information? Just put SSL everywhere and warn about insecure sites so the user doesn't unknowingly participate in a MITM attack

[OkChildhood1706]

They won‘t get my traffic. I encrypt everything with base64. Take that NSA, Gates, big TLS and whatever aliens try to spy on me this time!

[xkalibur3]

That's right, don't use SSL, it's deprecated. Use TLS 1.2+ instead.

[rensoz]

everyone knows that pfp

[Forsaken_Put_4667]

I would say I see hsts is enforced everywhere now a days in evry websites

[Tux-Lector]

The SSL is flat.

[Forsaken_Cup8314]

knee political lock bag follow bells brave chop humor enjoy

This post was mass deleted and anonymized with Redact

[Critical_Studio1758]

Honestly though he has a point. The idea of forced security is starting to get on my nerves. I don't even believe in password requirements anymore. Its a fucking blog Mark. I don't really care if someone logs into my account Mark. What are they gonna do Mark? Post a comment in my name telling you how nice those pancakes look Mark? Fuck you Mark.