HTTPS for EEVBlog Forums? - Page 1
Forum section: electronics / general

author: AntiProtonBoy
author_rank: Frequent Contributor
timestamp: September 12, 2016, 02:49:50 am
content: I didn't know where to post this, but may I make the suggestion of making SSL/TLS connections default on the EEVBlog and the forum?https://www.eevblog.com/forum/only offers partically encrypted content, but the forum itself embeds HTTP URLs instead of HTTPS.Let's Encrypt now offers free certificates. Apache can be also configured to automatically redirect HTTP URLs to HTTPS.

author: IanB
author_rank: Super Contributor
timestamp: September 12, 2016, 02:53:40 am
content: But, er, why?

author: EEVblog
author_rank: Unknown
timestamp: September 12, 2016, 03:00:32 am
content: This is forum, not a bank.

author: AntiProtonBoy
author_rank: Frequent Contributor
timestamp: September 12, 2016, 03:02:21 am
content: Apart from the obvious reasons of keeping data private while in transit, there is now a push by browsers to discourage the use of HTTP, particularly when sending credentials, such as logins and passwords. There is really no excuse not to use TLS any more now that Let's Encrypt offers certificates for free.

author: EEVblog
author_rank: Unknown
timestamp: September 12, 2016, 03:04:42 am
content: This has been discussed on here many time before and the consensus was that it's not worth the effort.

author: AntiProtonBoy
author_rank: Frequent Contributor
timestamp: September 12, 2016, 03:11:18 am
content: Depends on your web host, I suppose?I'm using a shitty shared hosting package for my forum, and I could install TLS with a single click of a button, and just add a mod_rewrite entry in .htaccess to redirect HTTP traffic to HTTPS.Anyway. Your call obviously.

author: Halcyon
author_rank: Unknown
timestamp: September 12, 2016, 03:27:12 am
content: I've brought it up once before and it was decided down. I guess as long as you're not using the same password anywhere else, it won't matter. I personally opt to use HTTPS everywhere where it's available.Quote from: EEVblog on September 12, 2016, 03:00:32 amTo be honest, these days, that's not really a fair argument. There are several reasons why even the most trivial sites should employ HTTPS. I understand you need to weigh up the benefit vs. effort of implementing the solution. It's a bit like people not caring about their privacy during phone calls or SMS's because "they have nothing to hide", that's not the point.

author: AntiProtonBoy
author_rank: Frequent Contributor
timestamp: September 12, 2016, 04:01:35 am
content: Yeah, big vacuum cleaners on large internet pipes just collect everything. The harder we make data collection for them the better it is for us. Using TLS goes beyond just practical security. It's also about making a stand against unethical data collection. Again, up to Dave's discretion where he stands on this issue, but I think protecting user's data is worth considering, especially for users situated in countries with a high risk of getting persecuted for the stupidest things.I'm also predicting that browsers in the near future will be more aggressive about flagging raw HTTP as unsafe. I believe Chrome already does this for forms containing a password field. Time to get prepared me thinks.

author: EEVblog
author_rank: Unknown
timestamp: September 12, 2016, 05:25:55 am
content: IIRC it was investigated by gnif (resident server maintainer) and it was not as trivial as you make it out to be, and most decided it wasn't imporatnt.No other forums I'm on use httpsHardly anyone is asking for it, not a single person has quit or refused to join the forum because it doesn't have it, and quite frankly not moving to it is one less thing that can go wrong.

author: Monkeh
author_rank: Super Contributor
timestamp: September 12, 2016, 05:27:51 am
content: Quote from: EEVblog on September 12, 2016, 05:25:55 amIt's trivial except for the CloudFail, err, Flare, issue.

author: AntiProtonBoy
author_rank: Frequent Contributor
timestamp: September 12, 2016, 05:35:45 am
content: QuoteI don't know what kind of hackery is required to get this working on your hosting service, so fair enough. That said, I wasn't kidding about click of a button thing with the hosting company I'm with (VentraIP). I just assumed other hosting services offered a similar thing.

author: JPortici
author_rank: Super Contributor
timestamp: September 12, 2016, 06:42:01 am
content: Quote from: Halcyon on September 12, 2016, 03:27:12 amthere is a firefox extension: HTTPS anywhere, it will try to use HTTPS on any weebsite.too bad it crashes most of them, especially forums.okay, this is not the best example but if you ever tried the microchip forumthe software will refuse to work with https, you won't even be able to write a post because the applet won't start with https

author: KE5FX
author_rank: Super Contributor
timestamp: September 12, 2016, 08:54:30 am
content: Why do I care about "privacy" on a site where the whole idea is to post a message on a public bulletin board?If someone sniffs my password, I guess that could be a much bigger problem. Who knows what could happen? They might be able to log into my accounts on Reddit, Fark, and Disqus, and... um... read some more stuff that I posted with the intention of making it public.

author: nfmax
author_rank: Super Contributor
timestamp: September 12, 2016, 09:11:14 am
content: The dangers are more subtle than mere password sniffing. There is the possibility that the content either of the site itself, or more probably of one of the advert syndication services or CDNs it uses is modified by a malicious actor to inject a JavaScript attack or a link to a site containing such an attack. This may be able to gain privileged access to your machine and then it's Game Over. Today, probably ransomware is the most likely payload, but they might just be after your contacts and email account, as a staging post to a credible phishing attempt on someone else. 'They' could be anyone from Russian or Ukranian crime syndicates (other nationalities are also available) to state actors. You may well not be the target - but your machine might get trashed just to cover their tracksI am not an expert (though I know people who are) but IMHO it is starting to become dangerous to allow JavaScript and adverts on non-encrypted connections

author: imidis
author_rank: Frequent Contributor
timestamp: September 12, 2016, 09:34:02 am
content: I don't care either way, however, I buy the godaddy $5.99 ssl cert, the non verified non-wildcard. (one domain prefix only) They give me a zip file then I install it on my server. Didn't really find it that complicated.

author: 3db
author_rank: Frequent Contributor
timestamp: September 12, 2016, 09:50:40 am
content: Quote from: AntiProtonBoy on September 12, 2016, 03:11:18 amHave you done this ?

author: 3db
author_rank: Frequent Contributor
timestamp: September 12, 2016, 09:59:54 am
content: There is NO such thing as internet security.Anything on the net can be hacked etc,etc.

author: Halcyon
author_rank: Unknown
timestamp: September 12, 2016, 10:15:30 am
content: Quote from: EEVblog on September 12, 2016, 05:25:55 amIt's clearly a feature some (including myself) would like to see implemented as it's been brought up a number of times. Saying no one has quit or joined is all well and good, but it's almost impossible to provide stats on that unless they tell you. As for another thing to go wrong, normally I'd agree with you, but it's old technology that is been tried and tested. I personally believe the benefits outweigh the off-chance something was to go wrong.Maybe gnif can weigh in on the conversation since he knows the server and site set up intimately. I suppose it's one of those things, once implemented (even if it requires a bit of work to get there) can be left alone to do its thing for the mid-to-long term.I'd have to say, 90% of the websites I visit use HTTPS as standard, including news sites, hell even porn sites.

author: EEVblog
author_rank: Unknown
timestamp: September 12, 2016, 11:07:29 am
content: Quote from: Halcyon on September 12, 2016, 10:15:30 amOne thing I do know is that we (mostly gnif) has spent a long time getting this server running optimally in all sorts of ways. Things you think won't be a problem and should be easy have a nasty habit of causing no end of trouble.

author: magetoo
author_rank: Frequent Contributor
timestamp: September 12, 2016, 11:08:03 am
content: Quote from: Halcyon on September 12, 2016, 10:15:30 amI'd most likely quit if the forum moved to HTTPS. (Not a great loss perhaps.) Old browsers don't really handle currently popular encryption standards well, and the defaults in most places seems to be very particular about who's allowed to connect. I'm already having to manually change all URLs to "http:" on the non-forum EEVblog pages.On the other hand, if someone is involved who really knows their stuff and can test things, fine. But I get the feeling that most web devs will do a quick check with a recent Chrome version and call it a day.

author: RGB255_0_0
author_rank: Frequent Contributor
timestamp: September 12, 2016, 11:25:31 am
content: Quote from: magetoo on September 12, 2016, 11:08:03 amJust because you don't care about your security doesn't mean others should be forced to because of your lackadaisical view.

author: ovnr
author_rank: Frequent Contributor
timestamp: September 12, 2016, 11:30:11 am
content: +1 for not bothering w/ HTTPS. You shouldn't be reusing your login credentials anyway, and what you post is public anyway.The whole "Ooh! Let's encrypt all the things!" push is pointless, and that's coming from someone intensely angry about surveillance and privacy issues (specifically, the lack of privacy).

author: forrestc
author_rank: Unknown
timestamp: September 12, 2016, 11:31:02 am
content: Quote from: EEVblog on September 12, 2016, 11:07:29 amSSL connections tend to be far more resource intensive than non-encrypted ones. It doesn't surprise me that SSL would be something which you wouldn't want to enable by default if you care about CPU load.And before someone mentions it: Yes, some of this can now be handled in hardware with encryption co-processors. But even with those, just doing the SSL handshakes can be expensive.

author: wilhelm
author_rank: Contributor
timestamp: September 12, 2016, 11:32:40 am
content: Quotehttps://security.googleblog.com/2016/09/moving-towards-more-secure-web.html

author: magetoo
author_rank: Frequent Contributor
timestamp: September 12, 2016, 11:35:54 am
content: Quote from: RGB255_0_0 on September 12, 2016, 11:25:31 amI won't stop anyone from typing in "https" in the address bar. HTTPS by default has stopped me from seeing quite a few sites, so I think you've got it backwards.If things are done right, both HTTP and HTTPS should work. But it often doesn't.

author: RGB255_0_0
author_rank: Frequent Contributor
timestamp: September 12, 2016, 11:54:22 am
content: Quote from: magetoo on September 12, 2016, 11:35:54 amIf you're using out of date browsers that's a problem brought onto yourself. Not surprised your browser can't visit HTTPS if it doesn't support 256bit, which is probably the case.

author: magetoo
author_rank: Frequent Contributor
timestamp: September 12, 2016, 12:13:37 pm
content: I offered my opinion, that backwards compatibility is important. Continuing to support HTTP has zero impact on you.If you have a problem with someone merely having a different point of view than you, that's not "a problem I brought on myself".

author: madires
author_rank: Super Contributor
timestamp: September 12, 2016, 12:16:21 pm
content: Quote from: forrestc on September 12, 2016, 11:31:02 amhttps://www.maxcdn.com/blog/ssl-performance-myth/

author: Jeroen3
author_rank: Super Contributor
timestamp: September 12, 2016, 12:22:01 pm
content: Quote from: JPortici on September 12, 2016, 06:42:01 amOnly poorly configured ones. Ones that do allow https connections, but not all content is available over https.Good example is TI's website. If you force https, the css file doesn't make it. And you have a plaintext webpage.

author: EEVblog
author_rank: Unknown
timestamp: September 12, 2016, 12:43:21 pm
content: Previous discussion, with input from gnif on why it was not done at the time:https://www.eevblog.com/forum/chat/secure-version-of-the-forum/

author: AntiProtonBoy
author_rank: Frequent Contributor
timestamp: September 12, 2016, 01:00:08 pm
content: Quote from: 3db on September 12, 2016, 09:50:40 amYes.Quote from: magetoo on September 12, 2016, 11:08:03 amWhat on earth are you using? Netscape Navigator Gold? IE6 or something?Quote from: ovnr on September 12, 2016, 11:30:11 amThe whole idea behind encrypting traffic is to make surveillance difficult. If you care about privacy, then you'd care about protecting data. Your stance is contradictory.

author: Kjelt
author_rank: Super Contributor
timestamp: September 12, 2016, 01:57:01 pm
content: The only security it offers is if someone types in his password when connected to a public (fake) internet AP and the owner has his login credentials. Although I still hope (have to check) that only the hash will be transferred not the password in the clear.The only user where this will have serious consequences will be the admins. So as long as the admins do not use any public internet AP's to look at the forum it will be ok'ish I guess, still I also find it weird that anno 2016 a website does not support https, but indeed a lot of forums don't do this.

author: rstofer
author_rank: Super Contributor
timestamp: September 12, 2016, 01:58:07 pm
content: Quote from: AntiProtonBoy on September 12, 2016, 01:00:08 pmOther than the 'pillowcase full of chad' approach to hiding stuff, what's the point? Everything that is posted ultimately winds up as plaintext on the forum. If the data is going to wind up as text on a srceen, it might as well be text during transmission. Leaving it as plaintext takes a certain load off my computer. Not a big load but compute cycles nevertheless.My browser is fully capable of handing https but I don't see any reason for a forum like this to use it.If I want privacy, I would disconnect from the Internet and pull the batteries out of my cellphone.

author: hammy
author_rank: Unknown
timestamp: September 12, 2016, 02:23:26 pm
content: Quote from: rstofer on September 12, 2016, 01:58:07 pmNo, there are private messages inside this forum about reverse engineering scopes and firmware. Some people are from countries with laws against this. Even the metadata about these conversaitions is precious.If some people don't see a reason for this ... it does not mean there is no reason at all for other people.If some people don't want to use SSL because ofthe load on their cpu... they are free to connect without ssl.But for some people there is a valid reason to encrypt the connection for their privacy!Cheershammy

author: Kjelt
author_rank: Super Contributor
timestamp: September 12, 2016, 02:26:12 pm
content: The load on their cpu?Only the TLS handshake takes some processing power because it is assymetrical, that is once per connection.After that the entire encryption/decryption algo's are symmetrical and take <1% of any modern CPU after 2005.

author: magetoo
author_rank: Frequent Contributor
timestamp: September 12, 2016, 02:35:54 pm
content: Quote from: AntiProtonBoy on September 12, 2016, 01:00:08 pmAn older version of Opera (using the old rendering engine); it's fast on a slow machine and pretty low on resource use. It does HTTPS just fine, just not with all the most recent encryption.The problem is that some sites are set up to refuse using older, less secure variants of HTTPS, so I end up switching to plain HTTP despite both ends supposedly supporting encryption. (And of course there's no way to have it use OpenSSL, which has all the crypto bells and whistles. The irony is that the ancient "links" browser does.)

author: madires
author_rank: Super Contributor
timestamp: September 12, 2016, 03:27:23 pm
content: Quote from: Kjelt on September 12, 2016, 01:57:01 pmThere are much more reasons for https. Another one might be your ISP. Some ISPs do some very nice things like replacing or inserting ads on the fly on the web pages you read. SSL makes it harder for them. The Internet isn't a cozy place like 25 years ago, it's a fish tank full of hungry sharks and other fish looking for some easy meal.

author: Kjelt
author_rank: Super Contributor
timestamp: September 12, 2016, 03:35:16 pm
content: You mean tracking cookies? An ISP i am not worried about. With or without tls if the forum is infected with some script hidden in some content you be screwed if your malware scanner does not recognize it.

author: AntiProtonBoy
author_rank: Frequent Contributor
timestamp: September 12, 2016, 03:47:17 pm
content: You mean supercookies? Yeah. Some ISPs like Verizon is literally injecting data into the HTTP stream. There is really not a lot you can do, unless you're accessing a site that supports HTTPS, or if you're use a VPN. It's fucked.http://webpolicy.org/2014/10/24/how-verizons-advertising-header-works/

author: madires
author_rank: Super Contributor
timestamp: September 12, 2016, 04:06:56 pm
content: Quote from: Kjelt on September 12, 2016, 03:35:16 pmNot just tracking cookies. Such an ISP could replace the TI ad I'm seeing right now with an ad for blue pills, for example. So Dave would get less revenue, in case of pay per click. Yes, if someone finds a CSS or SQL injection vulnerability in the forum's software, SSL/TLS doesn't help. But it helps, when the ad your ISP inserts contains malware. This is not a theoretically attack, it already happened several times.

author: orin
author_rank: Frequent Contributor
timestamp: September 13, 2016, 12:13:05 am
content: Quote from: madires on September 12, 2016, 04:06:56 pmGood point. SSL/TLS establishes a level of trust that what you are seeing in your browser is what was served by the forum. With plain http, you cannot trust any link posted since a MITM attack or as you say, an ISP, can replace it at will. But there will be the response that you should check that links aren't pointing somewhere malicious. Sure, but what about tinyurl and similar links. What about the link that was OK yesterday or last week?For this reason, I'd support end to end HTTPS for the forum.

author: FlyingHacker
author_rank: Frequent Contributor
timestamp: September 13, 2016, 12:47:23 am
content: You mean you guys don't see the ads for blue pills on EEVBlog forum?Seriously, I am all in favor of it for both making it more difficult for the knuckleheads in Utah to read, as well as prevent injection of ads/malicious code/tracking tools.

author: EEVblog
author_rank: Unknown
timestamp: September 13, 2016, 03:11:34 am
content: Quote from: Kjelt on September 12, 2016, 02:26:12 pmThis server database handles about half a million connections per hour.

author: forrestc
author_rank: Unknown
timestamp: September 13, 2016, 04:43:49 am
content: Quote from: Kjelt on September 12, 2016, 02:26:12 pmPlease look at he chart which says "Server Impact" on this website:http://scn.sap.com/community/netweaver/blog/2013/06/23/whos-afraid-of-sslNote that moving from 'plaintext to SSL all-new resulted in nearly 3x the cpu load'. They gloss over this by saying that 'well it's really only 5% of total usage on a core'.The concept that SSL has minimal impact simply isn't true in every case. It is definitely true that in many cases anymore it's as simple as 'turning it on', since web servers tend to be lightly loaded CPU-wise and/or have encryption processors in them which minimize the load - or the load mix is such that the contribution of SSL isn't going to be enough to worry about it. On the other hand, the idea that you can take a busy server which is spending a lot of it's CPU just providing pages and just turn on SSL without understanding the performance impact is dangerous and wrong. I don't have enough knowledge about the backend hardware of the eevblog to say whether this is the case or not.... but at the point you're having to tune things to make them actually perform well enough to work on the hardware you have, adding something like SSL isn't something you can take lightly.

author: Galenbo
author_rank: Super Contributor
timestamp: September 13, 2016, 10:59:20 am
content: Quote from: AntiProtonBoy on September 12, 2016, 01:00:08 pmSome people don't believe in "privacy on internet" , maybe because every country is logging everything by their local variant of NSA.SSL, TLS, or whatever other "technology", is either invented or tolerated by those organisations.Another big hit are those "anonymous browsers" that are developed and put on torrent by "some organisation"That's the work of the Maffia or NSA. Some people believe that's the same.Privacy=data on a disk, in a computer without network.

author: madires
author_rank: Super Contributor
timestamp: September 13, 2016, 01:18:29 pm
content: Quote from: forrestc on September 13, 2016, 04:43:49 amSince it's software written by SAP, we can assume it's a worst case scenarioQuote from: forrestc on September 13, 2016, 04:43:49 amOf course, you shouldn't just enable https. You have to do your homework first, e.g. which SSL/TLS versions to support and which chiphers. There are several ways to improve the SSL performance. More food for thought and some hints:-https://www.keycdn.com/blog/https-performance-overhead/-https://unhandledexpression.com/2013/01/25/5-easy-tips-to-accelerate-ssl/

author: Kjelt
author_rank: Super Contributor
timestamp: September 13, 2016, 02:34:31 pm
content: Quote from: forrestc on September 13, 2016, 04:43:49 amThey use a very weird TLS scheme:QuoteThis is not how normal TLS schemes work, perhaps for ultra secure banking transactions you might do this but for 99,99% of all TLS traffic after the initial handshake you can sent and receive 4GB of data before you want to renegotiate and even more is possible before there is a security risk.

author: AntiProtonBoy
author_rank: Frequent Contributor
timestamp: September 13, 2016, 02:54:34 pm
content: Quote from: Galenbo on September 13, 2016, 10:59:20 amSo, if NIST helps security agencies to develop crypto, they should be automatically dismissed? It doesn't matter who invents what. The aforementioned algorithms, code, and mathematics are out there for anyone to scrutinise, peer review and put to the test. If it has engineered flaws, it will be found (as is the case with dodgy elliptic curves, such as Dual_EC_DRBG).Surveillance agencies are just as interested in protecting their own data as anyone out there. And they develop technology that is capable of doing that. And the best security is the kind where you can publish details how it works and the protection is actually offered by the mathematics. Makes little sense for those agencies to use back door-ed crypto that put themselves at risk.

author: System Error Message
author_rank: Frequent Contributor
timestamp: September 13, 2016, 08:46:46 pm
content: I've discussed this topic before on a networking forums. you only need https to authenticate yourself such as when logging in, otherwise it creates unnecessary load. Whats the point of https on an information site? You're not trying to hide data.the SSL but for https takes a lot of CPU on a server to handle a few Gb/s of throughput, so this being a site for sharing information is totally pointless for https. Only user authentication needs it.Unless your forum is secretive and so on no https is needed.

author: hammy
author_rank: Unknown
timestamp: September 13, 2016, 09:45:28 pm
content: Quote from: System Error Message on September 13, 2016, 08:46:46 pmQuote from: hammy on September 12, 2016, 02:23:26 pmhttp://motherboard.vice.com/read/google-chrome-shaming-http-unencrypted-websites-januaryCheershammy

author: System Error Message
author_rank: Frequent Contributor
timestamp: September 14, 2016, 12:56:37 am
content: i wouldnt call it shaming, just that web browsers dont display the http:// or https:// infront of urls anymore.Regardless its not worth the extra computing power required. Encryption is required for authentication and editing (like posting something new). For reading using it is just wasted CPU load. google chrome should notify you instead if you are trying to send data without using https or if you are trying to authenticate through http. The mass use of https will just mean needing more CPU for no reason and this is bad for many hosters. Is eevblog considered to be political enough that reading this from china will get you jailed?And dont talk about the man in middle security stuff. hijacking can be done properly so SSL isnt bullet proof.

author: Cerebus
author_rank: Super Contributor
timestamp: September 14, 2016, 01:39:26 am
content: Quote from: ovnr on September 12, 2016, 11:30:11 amNo, it's not. If you only encrypt the important stuff someone looking at your Internet traffic has a clear signal marking out important from trivial traffic. If you also encrypt the trivial traffic it makes traffic analysis harder by not flagging 'important' communications.

author: System Error Message
author_rank: Frequent Contributor
timestamp: September 14, 2016, 02:15:30 am
content: Quote from: Cerebus on September 14, 2016, 01:39:26 amhttps doesnt hide your source and destination and port. Pretty sure someone sniffing you would know whats important and not important. Is eevblog as important as your email, cloud services and online banking?

author: hammy
author_rank: Unknown
timestamp: September 14, 2016, 08:29:58 am
content: Quote from: System Error Message on September 14, 2016, 02:15:30 amFor my privacy everything is important.

author: Cerebus
author_rank: Super Contributor
timestamp: September 14, 2016, 01:06:19 pm
content: Quote from: System Error Message on September 14, 2016, 02:15:30 amPlease follow the thread of argument, the context is not merely HTTPS and eevblog but "Let's encrypt all the things!". (As an aside my mail server has been using opportunistic encryption for more years than I can remember, at least 10.) And no, the people sniffing you (insert name of your favourite intelligence agency here)don'talready know what's important and what isn't - they are collecting traffic data oneveryoneand have to sift out the important stuff by algorithmic means. It's been recorded that one of the criteria they use is "is it encrypted?" and if it is they select that traffic for storage; if encrypted becomes the new norm it ceases to be a useful selection criterion and hopefully stops ordinary folks traffic being slurped up into the spies data stores as it becomes too much to handle.The problem isn't that the spooks are spying on the bad guys and foreign governments, they are spying on everyone and that isn't acceptable and it's behoven on any of us who can do anything, no matter how little that might be, to stop it to do so. [Insert Pastor Niemöller quote here]Bringing the argument back to the eevblog: Once of the 'trending topics' on the Internet spying front is how hard certain countries are pushing at getting access to technology companies in general and military electronics in particular. The prime method for doing this is launching advanced persistent threats (APTs) at the individual engineers at those companies. This is where things like script and HTML injection come in, and eevblog has a useful concentration of engineers to launch those attacks at. The strongest argument for making eevblog HTTPS is to protect against those types of attack in general (authentication of origin) and it is not in the realm of the impossible or improbable that eevblog may have already been selected as a possible attack vector by some some bunch of spooks with economic or technological espionage on their minds.(Whoops, I hit send too soon there.)I suspect that there are a few people here who wouldn't ordinarily think of themselves as targets for the spooks of the world who are going to realise that in this context they are prime targets.

author: nfmax
author_rank: Super Contributor
timestamp: September 14, 2016, 01:09:41 pm
content: Quote from: Cerebus on September 14, 2016, 01:06:19 pmAt last somebody gets it!

author: arlipscomb
author_rank: Contributor
timestamp: September 14, 2016, 01:20:37 pm
content: A large engineering company I worked for (> 50,000 employees) was attacked by using a local engineering societies web site. The remote site was compromised and configured to deliver malware to visitors based on some social engineering and some knowledge of IP addresses in use. Could the use of HTTPS/TLS have prevented that attack? Doubtful at best.Now encrypting the login information and password fields have been considered standard fare for at least a decade now.

author: StuUK
author_rank: Frequent Contributor
timestamp: September 14, 2016, 01:41:18 pm
content: Quote from: nfmax on September 14, 2016, 01:09:41 pmUse of HTTPS does not protect against those type of attacks at all and if people use the same ids/passwords for a BBS site (or any non-encrypted authentication mechanism) as they do for more important sites (eg. online banking) then shame on them...

author: AntiProtonBoy
author_rank: Frequent Contributor
timestamp: September 14, 2016, 02:28:54 pm
content: I'll never ever understand the apathetic mindset shown towards privacy in this thread, and the blasé attitude towards the opportunity of using secure means of communication when it's available. If the tech is there, and IF it is not too much of a hurdle of actually using it, then use it! (Just to be clear, I'm not having a jab at you Dave... if there is a technical barrier in getting TSL happening, then so be it.)Whether you have nothing to hide is immaterial and is a red herring argument. Everyone has something to hide, even when posting on a public arena, such as this forum. Most of the time you don't know what info posted under your pseudonym is valuable until you actually get doxed. When you get attributed to those discussions, often in a deliberately damaging way and out of context, you will feel the pain. Curious, how many of would you be comfortable allowing your potential employer read the comments you made here? I'm willing to bet that sizeable number of people would not want that.

author: Cerebus
author_rank: Super Contributor
timestamp: September 14, 2016, 02:32:45 pm
content: Quote from: StuUK on September 14, 2016, 01:41:18 pmInjection attacksareprevented by authentication of origin, as supplied by TLS, and it has nothing to do with selecting the same passwords for different sites. Injection attacks happen en-route via a compromised router or deliberate traffic misdirection (e.g. DNS cache poisoning, BGP shortest path manipulation or first-to-arrive packet races). Remember, the NSA interdicted Cisco routers being delivered to compromise them, they have proven compromises for many major router brands (e.g. Juniper), the Chinese would have no problems pre-compromising Huawei routers and the Russians no doubt have similar capabilities. If one thinks that any of the major powers doesn't have the capability to interfere with traffic to any given website then one is sadly mistaken.

author: madires
author_rank: Super Contributor
timestamp: September 14, 2016, 03:06:26 pm
content: Quote from: StuUK on September 14, 2016, 01:41:18 pmSuch an attack would require:- a way to intercept the traffic for a MITM- a valid fake certificate from a CA or a way to push the root cert of a fake CA to the client- a web browser with a poor visual indication of the trustworthiness of a certificate- an user not checking the certificateWith http it would be just intercepting the traffic, like some ISPs/carriers do for inserting ads.BTW, there are boxes for the https MITM, which are used in corporate environments, but require the fake root cert being pushed to the clients, i.e. via AD. They can be detected by checking the certificate.It should be clear that you don't get 100% security by any encryption protocol. The goal is to make it harder for attackers. Even just being able to detect if someone it tampering with your IP traffic is a huge benefit.

author: arlipscomb
author_rank: Contributor
timestamp: September 14, 2016, 06:00:15 pm
content: If I were running a business that had an online community attached to it, my worry would be that someone would sit in the middle and harvest account login information. Then when they had enough information start to use those accounts to cause problems. Someone could make a mess over several days that might go undetected for weeks.

author: Kjelt
author_rank: Super Contributor
timestamp: September 14, 2016, 06:45:10 pm
content: If configured correctly the forum is totally seperated from Dave's business, an overload on the forum should never interfere with business.

author: Cerebus
author_rank: Super Contributor
timestamp: September 14, 2016, 06:53:16 pm
content: Quote from: madires on September 14, 2016, 03:06:26 pmFrom Bruce Schneier's blog earlier today, discussing a series of nation-state level 'calibration' attacks seen recently:Quote from: Bruce SchneierYou can read the whole thing athttps://www.schneier.com/blog/archives/2016/09/someone_is_lear.html.

author: madires
author_rank: Super Contributor
timestamp: September 14, 2016, 07:43:23 pm
content: Quote from: Cerebus on September 14, 2016, 06:53:16 pmUnfortunately a lot of ISPs and carriers don't apply proper prefix flters for the route announcements of BGP peers. There's also RPKI, but not widely supported. We've seen route hijacking by configuration mistakes so many times, still several ISPs/carriers don't care. Now this is misused on purpose. Some people never learn.

author: Cerebus
author_rank: Super Contributor
timestamp: September 14, 2016, 08:57:15 pm
content: Quote from: madires on September 14, 2016, 07:43:23 pmI remember sitting in a LINX meeting in 1996 or 1997, after yet another massive route leak, discussing solutions beyond filtering prefixes and here we are twenty years later and it's still a problem. By now RPKI or some similaradmittance controlprotocol ought to have been universal. As it is there aren't even RPKI certificates issued for all of the IPV4 address space.

author: apelly
author_rank: Unknown
timestamp: September 14, 2016, 09:45:34 pm
content: I'm not feeling particularly verbose or articulate today, but here are a couple of articles I stumbled across this morning while researching unrelated security:Some interesting points:https://scotthelme.co.uk/still-think-you-dont-need-https/QuotePage load times. Relevant to cloudflare. And nobody needs to be told that slow load times directly affect revenue.https://www.httpvshttps.com/QuoteObservations about where encryption is heading:https://scotthelme.co.uk/the-encryted-web-is-coming/QuoteBehind the scenes geek stuff. TLS overhead:https://istlsfastyet.com/QuoteRandom: Check site policies and security in place at your favourite web site.https://securityheaders.io/?q=https%3A%2F%2Fwww.eevblog.com%2Fforum%2F

author: System Error Message
author_rank: Frequent Contributor
timestamp: September 15, 2016, 01:18:52 am
content: whether encrypted or not all data is stored. The feds have enough storage even if the whole internet was encrypted. Infact not all headers are encrypted. As i said source and destination can be seen and so are the protocols used.The other thing is that https security relies on the SSL software stack which has had some updates in the past few years so its not 100% secure. If you really want to defeat spying than use vpn and proxies. Just https alone doesnt help as they probably have the computing power needed to decrypt your stuff in minutes.

author: Kjelt
author_rank: Super Contributor
timestamp: September 15, 2016, 05:31:50 am
content: Quote from: System Error Message on September 15, 2016, 01:18:52 amAs long as the client does not offer weak ciphersuites or the server does not accept weak ciphersuites nobody is going to decrypt the data except the client and server. Only exception is if there is a zero day in one of the software codes. It is not for nothing that police and government agencies are lobbying with politics to weaken or abandon encryption, because they are not able to decipher the data.Thiese kind of statements are scientificly speaking unproven sentimental gossip and are not usefull at all in a discussion. Please keep them to yourself or proof that aes for instance which is the most common used cipher is broken.

author: Bud
author_rank: Super Contributor
timestamp: September 15, 2016, 06:32:03 am
content: Quote from: Kjelt on September 15, 2016, 05:31:50 amIf by the server you mean the ultimate destination server then in general your statement is not correct. Https can be decrypted by proxies, there are bunch of products on the market for "SSL inspection". Having said that, it may be subject to legal limitations and the network scope (corporate vs public proxies), but this is not the same as "nobody is going to decrypt" claim. SSL decryption may be closer than one may think, example being personal antivirus running right on the user's computer, it may have SSL inspection setting.

author: Jeroen3
author_rank: Super Contributor
timestamp: September 15, 2016, 07:32:11 am
content: Haha. Passwords are not stolen by mitm attacks. They are stolen by SQL injection or other database attacks.And even then, only password re-users are vulnerable. Don't re-use password people!

author: 3db
author_rank: Frequent Contributor
timestamp: September 15, 2016, 07:58:30 am
content: Quote from: madires on September 14, 2016, 03:06:26 pmDo seriously believe that the CA's Verisign etc haven't given away the keys to Gov ? :

author: Kjelt
author_rank: Super Contributor
timestamp: September 15, 2016, 09:27:59 am
content: Quote from: Bud on September 15, 2016, 06:32:03 amI might misunderstand you but if you have a TLS connection with a proxy you should have the certificate of that proxy on your browser, eg you have once accepted the trust of that proxy.If not you can not setup unknowingly a TLS with that proxy. Even if you setup a TLS through a proxy it will only terminate and setup a new TLS connection with the destination server if it can access the datapackets, and you can see that this is happening because the certificate of the destination server is or not shown or it is signed by the proxy.So left or right you know someone is in between and you should be aware of that.If you directly setup a TLS connection between your computer and the destination server no-one can interfere with that.

author: EEVblog
author_rank: Unknown
timestamp: September 15, 2016, 10:02:11 am
content: Quote from: wilfred on September 15, 2016, 07:21:42 amNot that I'm aware of, but you'd have to ask gnif again.As for other forums, most other forums I use do not use https.Examples of ones that do are Adafruit and Sparkfun but you'd expect them to use it because their entire site is based around and ecommerce sales focus that needed that, so the forums https just came along for the ride.

author: madires
author_rank: Super Contributor
timestamp: September 15, 2016, 11:39:19 am
content: Quote from: Bud on September 15, 2016, 06:32:03 amI recommend to read something like Network Security by Kaufman, Perlman & Speciner to get your basics right. The boxes you're describing are web proxies with fake certificates. Your web browser connects to the proxy, not the web server. And if you would check the certificate, you would detect that easily. Those SSL inspection devices can't decrypt any https traffic not destined to themselfes as a web proxy. For a more reliable detection of fake certificates and a big red alert pop-up (users are lazy) we might get a RFC for web certificates via DANE.

author: Bud
author_rank: Super Contributor
timestamp: September 15, 2016, 02:13:51 pm
content: Thank you very much for the recommendation which i am not going to take because i know this. I was simply pointing to technical possibility of SSL decryption between a source and its ultimate destination, without going into details of the actual methods used. You do not specifically "direct" your traffic to the proxy when you typehttps://whatever.comin the browser and that is all that matters for the purpose of this discussion.

author: Cerebus
author_rank: Super Contributor
timestamp: September 15, 2016, 02:26:05 pm
content: Quote from: System Error Message on September 14, 2016, 02:15:30 amA further point on this. Eevblog is actually distributed by the Cloudflare content distribution system. If you were using HTTPS to connect, someone sniffing your traffic would only be able to see that you were connecting to Cloudflare. They would not be able to see which of Cloudflare's 2,000,000 customer sites you were actually connecting to. The statistics are probably worse than that in that Cloudflare use IP address pools but an individual website will only use one of those IP addresses so the detection odds shorten to 1 in a few thousand, but that's still very useful in minimizing the usefulness of traffic analysis. It does however introduce Cloudflare as a trusted third party because of the way they work HTTPS, which is not so good.

author: Kjelt
author_rank: Super Contributor
timestamp: September 15, 2016, 02:36:31 pm
content: Quote from: Bud on September 15, 2016, 02:13:51 pmYour technical possibility assumes a lot of things that are not very relevant for the discussion either.If you have a hard URL that DNS servers around the world can resolve there is no way some malicious 3rd party can intercept that with a proxy without you knowing it just by looking at the certificate and the url you are connected to. If you think that is possible show some proof cause and present it on defcon or blackhat and be famous.

author: Kjelt
author_rank: Super Contributor
timestamp: September 15, 2016, 02:48:04 pm
content: To further elaborate on this you can only hijack traffic from Alice(you the client) to Bob (server) and get away with it if you perform one of the following:WPAD hijacking, DNS hijacking, DNS cache poisoning or a BGP route hijack and then you need a valid CA signed certificate for Bob that Alice will accept and you need Bobs private key.Which means you have succesfully hacked a CA like Diginotar in the past or have hacked Bob and obtained its private key. Any other case you know you are not dealing with Bob OR you can not decipher the code.But this is to my knowledge, please share your solution.

author: madires
author_rank: Super Contributor
timestamp: September 15, 2016, 04:00:30 pm
content: Quote from: Bud on September 15, 2016, 02:13:51 pmIf you know the basics, why are you still claiming that a proxy can decrypt a proper end-to-end TLS connection? And of course, the technical details matter. Also of course, you don't add the proxy to your browser's settings, it's a transparent proxy. And if you check the certificate, you'll see it's a fake one from the proxy. So you know you can't trust the connection. This is one of the important features of TLS and certificates.Just for clarification: A proxy can impersonate a server successfully, when you are able to retrieve the keys from the server.

author: Kjelt
author_rank: Super Contributor
timestamp: September 15, 2016, 05:47:21 pm
content: Quote from: madires on September 15, 2016, 04:00:30 pmOr as I already said have a "valid" certificate and private key for that specific server that the clients browser will accept, which in practice means a CA was hacked.Not impossible but so rare it is very unlikely and in both cases the security was already broken.

author: KE5FX
author_rank: Super Contributor
timestamp: September 15, 2016, 11:24:39 pm
content: Quote from: AntiProtonBoy on September 14, 2016, 02:28:54 pmThe idea behind the Web was that there wouldn't be any "hurdles" at all. No hurdles, and no gatekeepers, and that includes SSL vendors and certificate authorities. If I want to serve a page consisting of nothing but<html><body>Hello, world!</body></html>, I should be able to do that with 20 lines of C code. If I want to run a multibillion dollar e-commerce site, I should be able to dothatwith nothing more than a few more lines.This principle was, and is,important. Far more important than any outdated (and grievously mistaken) notion of "privacy" that some people seem to expect when they hook up a network cable to their computer and start typing stuff.Does that mean that it's a good idea to run an insecure e-commerce site? Of course not. But it was certainly a good idea to make it possible to publish information without asking anyone else's permission. Everything beyond that is rightfully the server owner's call, and no one else's.

author: AntiProtonBoy
author_rank: Frequent Contributor
timestamp: September 16, 2016, 12:40:23 am
content: The idea behind the web is to connect people. How they communicate is their prerogative, whether it'd be plaintext or an encrypted stream.

author: AntiProtonBoy
author_rank: Frequent Contributor
timestamp: September 16, 2016, 12:43:40 am
content: https://www.eevblog.com/forum/QuoteIt's happening?

author: System Error Message
author_rank: Frequent Contributor
timestamp: September 16, 2016, 12:45:02 am
content: why stop at https? lets use vpns and proxies too for everything.

author: EEVblog
author_rank: Unknown
timestamp: September 16, 2016, 02:29:52 am
content: Quote from: AntiProtonBoy on September 16, 2016, 12:43:40 amNothing to see here, move along now.

author: orin
author_rank: Frequent Contributor
timestamp: September 16, 2016, 04:54:56 am
content: Quote from: 3db on September 15, 2016, 07:58:30 amPerhaps they have.But it's still not an argument against using TLS/SSL. IF the CAs have given the government their private keys, then the government could mount a successful attack against end to end TLS/SSL. Though why a government would bother to do so to get publicly available information beats me.The argument I see so far is that 'someone' can break TLS/SSL so there is no need to use it. I equate that argument to:"One shouldn't bother to lock one's front door as 'someone' with a decent set of lock picks can get in."You can never be 100% secure - whatever OS you use for your web server, your router or your client, open source or not. (And IMO, the number of security flaws found in an OS is proportional to the number of hackers looking for themwhich in turn is proportional to the number of users of the OS in question. In other words, at the moment, Windows is a more lucrative target for hackers due to the sheer number of Windows systems out there.)

author: apelly
author_rank: Unknown
timestamp: September 16, 2016, 09:10:20 pm
content: Quote from: System Error Message on September 16, 2016, 12:45:02 amI know, right?But then again, just because we're ignorant, curmudgeonly security luddites doesn't mean everyone else is, hey?

author: Jeroen3
author_rank: Super Contributor
timestamp: September 20, 2016, 10:41:45 am
content: It's time.Chrome started doing warning icons.

author: Halcyon
author_rank: Unknown
timestamp: September 20, 2016, 11:40:00 am
content: I'm sure Dave and Gnif are trying. But I will say this, privacy should be an option for those who want it rather than being left without a choice.

author: AntiProtonBoy
author_rank: Frequent Contributor
timestamp: September 20, 2016, 03:54:43 pm
content: Depending on how the server is configured, one can have both options.

author: Bud
author_rank: Super Contributor
timestamp: September 20, 2016, 04:53:00 pm
content: Quote from: Jeroen3 on September 20, 2016, 10:41:45 amIt is not because Chrome wants https, it is because a few things on the page cause rendering errors, one of which is the bloody Tapatalk. The Detail button gives exactly the details what is wrong.

author: RGB255_0_0
author_rank: Frequent Contributor
timestamp: September 20, 2016, 05:11:56 pm
content: Quote from: Bud on September 20, 2016, 04:53:00 pmNope. Refers to the connection. All non-HTTPS sites have the exclamation mark.

author: TheBay
author_rank: Unknown
timestamp: September 20, 2016, 05:54:44 pm
content: Quote from: RGB255_0_0 on September 20, 2016, 05:11:56 pmThe tapatalk is just an error.

author: RGB255_0_0
author_rank: Frequent Contributor
timestamp: September 20, 2016, 06:10:18 pm
content: I don't get the Tapatalk error. Anyway, this is for all non-HTTPS sites I visit. From BBC to Overclock.net, hotukdeals to reuters. Chrome is showing up all websites without a secure connection with an exclamation.

author: Jeroen3
author_rank: Super Contributor
timestamp: September 20, 2016, 06:13:58 pm
content: In january 2017 it getseven worse

author: IanB
author_rank: Super Contributor
timestamp: September 20, 2016, 06:19:39 pm
content: Quote from: RGB255_0_0 on September 20, 2016, 06:10:18 pmApparently it is only supposed to show the insecure icon if the web page contains a password or credit card field.

author: orin
author_rank: Frequent Contributor
timestamp: September 22, 2016, 12:59:06 am
content: Quote from: RGB255_0_0 on September 20, 2016, 05:11:56 pmIt's not an exclamation mark, just an 'i' in a circle, presumably for 'information'.You get a padlock icon for https connections.In either case, click the icon and you get a summary of information for the page. BOTH http and https have a details link which essentially brings up the developer tools with the Security tab selected.The tapatalkDetect error is just an error in the web page - you'd be surprised at how many web pages have errors that will show up here. My current gmail session has 86 errors!I don't see a problem here and the icon actually provides a faster path to the developer tools.

author: EEVblog
author_rank: Unknown
timestamp: September 22, 2016, 05:51:54 am
content: Quote from: orin on September 22, 2016, 12:59:06 amThat is new I have no idea why it shows that now.QuoteI see this too which I find incredibly puzzling because I have disabled SSL completely and deleted all certificates on both Cloudflare and the server!I'm magically no longer getting report of the site being down from Pingdom. I'm not sure it's the fault that fixed itself (likely a Cloudflare problem) or it had something to do with me deleting everything SSL related.

author: EEVblog
author_rank: Unknown
timestamp: September 22, 2016, 05:55:12 am
content: Quote from: Halcyon on September 20, 2016, 11:40:00 amGnif is currently on holidays so I've been playing and it didn't end well.Enabling SSLshouldbe pretty easy, as Cloudflare provide the certificate and i basically figured out how to enable evrything on the server as well, but gnif need to do some magic to make it work with nginx. I don't know how to do that.TLS support would require me to upgrade to a paid plan on Cloudflare.

author: tautech
author_rank: Super Contributor
timestamp: September 22, 2016, 06:16:30 am
content: Quote from: EEVblog on September 22, 2016, 05:51:54 amChrome did a self update in the last day or so, I've noticed this too.Yes the "i" is for site info, click it and a drop down appears with options to look further still.Forum gave grief today reporting 502's for various links/pages and still "Read replies" is giving me trouble.

author: EEVblog
author_rank: Unknown
timestamp: September 22, 2016, 07:33:45 am
content: Quote from: tautech on September 22, 2016, 06:16:30 amAll issues have stopped for me now, including posting delays.

author: tautech
author_rank: Super Contributor
timestamp: September 22, 2016, 08:05:59 am
content: Quote from: EEVblog on September 22, 2016, 07:33:45 amCleared browser history, all good now.