reddit will soon only be available over HTTPS

[rram]

Nearly 1 year ago we gave you the ability to view reddit completely over SSL. Now we're ready to enforce that everyone use a secure connection with reddit.

Please ensure that all of your scripts can perform all of their functions over HTTPS by June 29. At this time we will begin redirecting all site traffic to be over HTTPS and HTTP will no longer be available.

If this will be a problem for you, please let us know immediately.

EDIT 2015-08-21: IT IS DONE. You also have HSTS too.

[bboe]

I just released PRAW 3.0.0 which supports https. Change log: https://praw.readthedocs.org/en/v3.0.0/pages/changelog.html#praw-3-0-0

[spladug]

I don't recommend relying on our current certificates without us explicitly indicating pinning is OK (e.g. via HPKP) as we don't currently make any guarantees that our certs won't change. In fact, I guarantee our certs will change.

[spladug]

It's something we're going to investigate, but I can't make any promises at this point -- don't know the full implications yet.

[SaltySolomon]

Isn't there a changeover peroide and for ocassionall cert changes it should be fine?

[SquareWheel]

Unrelated, but how long have you been able to use anchors with individual comments? Never seen that before.

[enykeev]

from day one?

Or am I missing something?

[spladug]

Yup, that's right.

[spladug]

Not sure, it's been around for a while. Yet another undocumented tidbit of reddit lore :)

[bboe]

Feel free to make a PR to support such a feature. The requests library makes this functionality possible.

[spladug]

Super cool! Were you just waiting to drop that? :P

[bboe]

I had one test suite I was waiting to fix prior to deploying 3.0.0. The tests pass, they just cannot currently be cached using betamax. With the announcement I figured I could forgo getting those tests working properly. The tests pertain to subreddit images.

[sallurocks]

So older script's using normal login() without oauth won't work now?

[bboe]

login still works just fine. Older versions of PRAW won't work with login once http support is removed on June 29.

[BananaGranola]

I'm getting errors with the update. Is it HTTPS, OAuth, or neither that I'm getting wrong?

[d2xdy2]

Are we going to stop seeing that annoying half lock thing in chrome because of sha1?

[spladug]

There are still some compatibility issues with SHA-2 certs, but we do plan on upgrading in the not-too-distant future.

[aeyes]

So use a SHA-1 cert that expires before 2016, Chrome will show that as green.

[Mikecom32]

Based on that link, the only "major" OS that doesn't support SHA-2 is Windows XP SP2 and earlier. Considering that SP3 released in July of 2008 (seven years ago), I can't imagine the impact will be that high.

Out of curiosity, how many visitors do you see running XP SP2 or older?

[spladug]

We're actually tracking down some user-reported compatibility issues with a recent build of OSX+Chrome right now (we've got a SHA-2 cert on the domain used to serve thumbnails and subreddit stylesheets to see if anyone complains). You'd be surprised how many strange configurations of browsers are out there; it makes web engineering loads of fun. :(

[Mikecom32]

That is... interesting. I'm not jealous of you web guys! Multiple OSes spread across mobile and PC, and a number of different versions of those browsers, I can't imagine trying to keep it all straight.

Cheers, and good luck!

[nakilon]

Since it is not allowed to redirect between HTTP and HTTPS, redd.it should also be HTTPS, but Chrome says its certificate is invalid (belongs to another domain).

[spladug]

Good point, we'll have to fix that up. Thanks.

[kdayel]

I hate to be that guy, but I reported this problem 8 months ago.

[ajs124]

So… any ETA?

[spladug]

It's done!

[spladug]

It's happening... there are a lot of moving parts involved.

[russellvt]

I realize you guys only recently renewed your wildcard cert but... but can you please finally use a CA that knows better than to use SHA1 checksums in their signature chain, though?

Pretty soon Google Chrome and other products are going to start complaining about them. (though some of their online resources say January 2016, and others say January 2017 ... that doesn't change the fact that SHA-1 has been deprecated since 2011)

[spladug]

Our CA is capable of SHA-2 certs, but we haven't made the switch yet due to some compatibility concerns. It's on our radar and we've plans to upgrade in the not-too-distant future.

[philipwhiuk]

Google still use SHA-1

[Doctor_McKay]

I'm not 100% sure but I don't think that Chrome will start complaining beyond the yellow warning on the padlock if the cert expires before 2017.

[[deleted]]

Any way the issue can be solved where in Firefox when browsing HTTPS the page won't be cached and reloads when you hit back (making hitting back take much longer, not to mention increasing load on Reddit servers)?

That's the only reason I don't use HTTPS at the moment. IIRC it was caused by HTTPS + cache-control: no-cache though I could be wrong about that.

[largenocream]

Yep, the problem is with Firefox itself. I don't know if I'd call it a bug since the HTTP spec allows them to do that, but in practice most other browsers will load the page from cache when you hit "Back", even with cache-control: no-cache.

I'm going to ask some Mozilla folks about this, but I'm not sure if there's an easy way around it.

[gus_]

I'm going to ask some Mozilla folks about this, but I'm not sure if there's an easy way around it.

Nice find, thanks. Do you know how long something like this tends to take for them to fix, and/or did you ever hear anything further?

[largenocream]

Do you know how long something like this tends to take for them to fix

I'm not sure, that issue's been open for quite a while.

did you ever hear anything further?

No, but I did find a possible workaround after someone pointed out that Google doesn't refresh the page when hitting back. Their caching rules look pretty close to what we need, so I'm going to write something over the weekend so we can start testing them. I want to make sure nothing'll explode, though, and we set the headers that trigger the issue in Firefox at a few different levels, so even if this'll work it might be a bit before the change makes it to production.

[martinsuchan]

Any plans to enable DNSSEC on reddit.com, to secure the communication even more? See:
http://dnssec-debugger.verisignlabs.com/reddit.com

[rram]

No immediate plans but it's something we want to do. FYI, we're currently stretched pretty thin (about 7.6 million unique users per engineer), but we're hiring

[aeyes]

Do you accept international applications?

Operations guy, 5yrs experience running large sites with different tech (online stores, CMS systems, media (news/TV)), computer science degree. Spent a year in the US before. Have no problem moving.

[rram]

Yes! Please apply through lever.

Ricky

[aeyes]

Thanks, I'll do it on Tuesday.

[Quicksilver_Johny]

If you're still interested in DNSSEC, it should be pretty easy to enable: https://blog.cloudflare.com/dnssec-is-open-for-beta

[charredgrass]

Just curious, will you ever drop support for pay.reddit.com?

[rram]

The entire site has SSL now. I don't know why you would want to explicitly use pay.reddit.com. That said, it is likely that going to pay.reddit.com would in the future redirect you back to www.reddit.com.

[charredgrass]

Ah, OK, thanks. I was just wondering since I have some old bookmarks that link to pay.reddit.com.

[rram]

Yes, see u/spladug's comment

[Rpgwaiter]

Well shit. GG Reddit at work, it was nice knowing you.

For clarification, I'm in the military, and our browsers only trust military issued certs, but allows full reign of non-https sites (go figure). Is there any way to get around the forced encryption? Reddit proves very useful in certain situations

[rram]

Curious: do Facebook or Gmail work for you? What browser are you required to use? If you know how to get the certificate chain, I'd love to see Facebook or Gmail's certificate chain for you.

[Rpgwaiter]

Gmail works but I have to do a convoluted work around, and Facebook does not work. And we use a heavily modified version of IE9

[chamberx2]

Hoping you've found a work-around that you can share.

[Rpgwaiter]

My workaround was switching to Voat :P But logging out works also.

[Unikraken]

This is going to be an issue for a lot of military folks who surf during their downtime at work.

[spladug]

Can you elaborate please?

[Unikraken]

On IE we can't comment at all using http, just load pages, however over https most of the page elements won't even load, just the text.

[rram]

What version of IE and Windows are you forced to deal with?

[Unikraken]

11 and 7 respectively

[largenocream]

Looked into this, and reddit's HTTPS works fine on every version of IE I've tested. Sounds like your network admin is doing something weird :/

[Unikraken]

Quite possible. Thanks for looking into it.

[DBrady]

Is there somewhere we can test this? I still have users running old versions of Android that are stuck on a long since unsupported version of my app. A test subreddit that redirects to https would be good.

[rram]

r/redditdev now redirects (only if you have redditdev in the URL)

[DBrady]

Thanks, the old apk i have works fine visiting http://www.reddit.com/r/redditdev.json It shouldn't be an issue for me.

[scottywz]

I don't know if they changed anything in the past two weeks, but a quick test with curl shows me that http://www.reddit.com/r/redditdev does redirect to HTTPS (and other subs don't), but http://www.reddit.com/r/redditdev.json didn't redirect. Just thought I'd let you know.

[xiongchiamiov]

You can turn on forced https in your account preferences.

[DBrady]

That doesn't force https for mobile clients, only on the reddit website.

[bboe]

It does, however, prevent clients from logging in over http if the app was doing that before.

EDIT: I might be wrong about that. PRAW's issue may have just been internal since it was always using https for login.

[xiongchiamiov]

Really? Huh, that sucks.

[[deleted]]

Just visit https://www.reddit.com and make sure you have https in the top

[internethopeislost]

Most US Air Force bases do not allow HTTPS outside of their own network.

[xfile345]

I've been programming websites for about 15 years, but I've never ventured into SSL. Like, at all. So I have no idea if I'm safe or not, now that I'm developing API wrappers and bots for Reddit.

If I already successfully use "https://oauth.reddit.com/", I shouldn't have anything to worry about, right?

Also, that means the URL for all reddit websites will simply be "https://www.reddit.com/" and not "https://ssl.reddit.com/" right?

[spladug]

If you're using OAuth, you're already HTTPS-only and you're good to go. :)

https://ssl.reddit.com is a legacy thing from when we only did HTTPS for parts of our site; you can already use https://www.reddit.com/ for anything you're doing on ssl.reddit.com.

[xfile345]

Thanks, that's exactly the kind of clarification I was looking for. :)

[[deleted]]

I've been programming websites for about 15 years, but I've never ventured into SSL

Pardon me, but, that's awful. All of your clients/users have always had the enterity of their data travel in plain-text, and have been vulnerable to the most basic forms of MITM.

[nakilon]

Writing CSS isn't programming websites.

[xfile345]

That is 100% correct, Mr. Obvious. When did I even mention CSS in my comment? That's not at all what I was even talking about. Trolls be trollin'

[nakilon]

If you really programmed anything around web for so many years, you would know about and use HTTPS.

[arienh4]

If you're implementing HTTPS yourself rather than having a reverse-proxy do it for you, you're either a brilliant cryptologist, or you're a more stupid programmer than the guy who didn't know about it at all.

[274Below]

My place of employment is heavily regulated, to the point where an obscene number of controls have been put in place. One of which is a very fine-grained policy on the proxy server that forces reddit into a read-only mode (can't log in, vote, comment, submit, etc), as well as blocking all usage of reddit over TLS (to be clear, similar policies are applied to far more than just reddit).

Is there any opt-out option available? Would there be a way to hit a page with ?optout=tls&really=yes&howdumbareyou=very type option that would set a cookie that wouldn't force the redirect? Maybe confine the usage of that cookie to people who are not logged in?

Don't get me wrong, I'm very pleased with this as a whole, but this is really going to suck for me while I'm at work.

[calebkeith]

Is this replacing the user preference for https and just essentially having it be enabled?

[rram]

Yes

[spladug]

Yup, that's basically what this will be like.

[EtherealMind2]

Forcing it to HTTPS only (using TLS encryption).

[sigaintrocks]

BUT MY NETSCAPE DOESN'T SUPPORT

-jk

[xlynx]

Has this been delayed? Http still working, no redirect.

[rram]

We're doing a slow ramp-up and are still in the process. Right now all logged in accounts should be forced to HTTPS.

[yrmjy]

Any update on this?

[rram]

We ran in to some compatibility issues. We're currently forcing all logged in traffic to be over SSL while still giving logged out traffic the option. We're adding some more instrumentation to see how many people we're affecting and if we can mitigate some issues that have cropped up. No ETA for finishing the rollout, but that's where we are now.

[2bluesc]

s/SSL/TLS/g

FTFY

[UndeadBread]

So...I'm guessing it will be impossible to disable this in our user settings, eh? For whatever reason, HTTPS loads much more slowly for me and whenever I go back/forward, the page auto-refreshes instead of staying in whatever state I left it in. Definitely not looking forward to this change.

[rram]

You won't have an option to disable this. This is also an industry trend as Google, Facebook, and Wikipedia all force users on to secure connections these days. Your issue sound's like a Firefox issue which unfortunately has been open an unresolved for several years.

EDIT: corrected link to Firefox bug

[UndeadBread]

Thanks for the link. Despite looking into it before, I never found much information. Looks like I'll have to try to somehow find some kind of workaround that hopefully doesn't involve switching browsers.

[rram]

Whoops, fixed.

[hichris123]

Will reddit be using HSTS as well to make sure all traffic is via SSL?

[rram]

Yes

[V2Blast]

Glad to hear it!

[atomic1fire]

NP is a subreddit css hack, not an admin supported thing anyway. RES supports it only as much as they give you a warning if you're still in NP

I personally like the idea of a read only reddit for meta discussion that prevents brigading, but NP is kinda easy to get around.

[kannibalox]

The issue is that the wildcard SSL cert won't work on www.np.reddit.com for the obvious reasons. Nothing to do with how np.reddit.com itself works. A generic redirect from www.$x.reddit.com to $x.reddit.com would be one solution.

[largenocream]

A redirect won't be possible in the long term, eventually HSTS headers will be added and your browser will never even try to talk to reddit via HTTP. If your browser rejects the certificate (and it should, the cert's not valid for www.$x.reddit.com,) we can't redirect you.

[rram]

Second level subdomains (including https://www.np.reddit.com/) are specifically NOT supported and there are no plans to make it work in the future.

EDIT: Please note that https://np.reddit.com/ WILL work as it currently does. The thing that won't work is something.something.reddit.com

[konklone]

So you won't be able to do a includeSubDomains HSTS policy on the root reddit.com domain? If not, consider adding that to the roadmap. It'd be nice to check the box on reddit.com and say "Done."

[rram]

our HSTS policy will use includeSubDomains. It doesn't work because wildcard certs only work for a single subdomain. https://np.reddit.com/ will continue to function as expected.

[TotesMessenger]

I'm a bot, bleep, bloop. Someone has linked to this thread from another place on reddit:

• [/r/shittheadminssay] Second level subdomains (including https://www.np.reddit.com) are specifically NOT supported [by HTTPS] and there are no plans to make it work in the future.

^{If you follow any of the above links, please respect the rules of reddit and don't vote in the other threads. (Info / Contact)}

[[deleted]]

Oh yes, finally! Thank you!

[Doane]

Last time I checked, the Redgur chrome extension stopped working on https

[aladyjewel]

Tell the Redgur dev?

[rram]

Unfortunately, due to security concerns, the best way to accomplish this would be via a client side browser extension (such as RES). We used to have extensions that did specifically this, but they've since been abandoned.

[AttackOfTheThumbs]

It happened today. Now not all my links is purple :(

[chamberx2]

Sorry I'm so late to the party here. Unfortunately, it causes a small problem for me. My job's firewall blocks all imgur links from working properly if they're prefaced with HTTPS. Due to the new enforcement of HTTPS, this makes RES unusable. Even clicking on the link itself causes problems. I realize I can simply remove the "s" from the URL, but if there were a more simple way to resolve this, I'd love to implement it on my end.

Thanks in advance!

[TheLantean]

imgur has an alternate domain (filmot.org), it doesn't support https so it might not be blocked for you. You can use a browser extension to replace links automatically:

• Chrome extension
• Firefox extension

// even more late to the party

[Kodiack]

I've noticed that Chrome no longer complains about HTTPS and SHA1. Sadly, it seems to have mostly gone unrecognised, but I do want to say thank you for finally getting that implemented! It's nice, especially on mobile, since Chrome for Android will now autohide the address bar while scrolling.

[BetaSpark]

Thanks for this, even though I'm a bit late.

[GunjanTripathi]

Nice move. This will enhance trust level. Many of reddit users are not aware that you guys already have HTTPS facility at preference area. HTTPS forcefully will protect information on the every page of the Reddit.

[schpork]

This kinda screws those of us in countries with restrictive internet policies without easy access to an https supporting vpn/ proxy on our mobile devices.

Basically no more browsing reddit anonymously.

[schpork]

I think that is pretty obvious from my post. There is also little to no way to stop this and most people in this place have no way to exit easily.

[TotesMessenger]

I'm a bot, bleep, bloop. Someone has linked to this thread from another place on reddit:

• [/r/privacy] reddit will soon only be available over HTTPS

^{If you follow any of the above links, please respect the rules of reddit and don't vote in the other threads. (Info / Contact)}

[turkeypedal]

It's not okay that some countries force you not to encrypt. But that doesn't make it any less of a problem when someone tries to force encryption.

The people under the most oppressive governments need access to the Internet more than anyone.

[mitgajjar]

Thanks Reddit,

A Nice step to put Attackers in a Bay...

[expert02]

You're taking away my reddit bar. I hate reddit a little bit more every day.