HTTPS for EEVBlog Forums?

[RGB255_0_0]

Just because you don't care about your security doesn't mean others should be forced to because of your lackadaisical view.

I won't stop anyone from typing in "https" in the address bar.  HTTPS by default has stopped me from seeing quite a few sites, so I think you've got it backwards.

If things are done right, both HTTP and HTTPS should work.  But it often doesn't.

If you're using out of date browsers that's a problem brought onto yourself. Not surprised your browser can't visit HTTPS if it doesn't support 256bit, which is probably the case.

[magetoo]

I offered my opinion, that backwards compatibility is important.  Continuing to support HTTP has zero impact on you.

If you have a problem with someone merely having a different point of view than you, that's not "a problem I brought on myself".

[madires]

SSL connections tend to be far more resource intensive than non-encrypted ones.   It doesn't surprise me that SSL would be something which you wouldn't want to enable by default if you care about CPU load.     

https://www.maxcdn.com/blog/ssl-performance-myth/

[Jeroen3]

there is a firefox extension: HTTPS anywhere, it will try to use HTTPS on any weebsite.
too bad it crashes most of them, especially forums.

Only poorly configured ones. Ones that do allow https connections, but not all content is available over https.

Good example is TI's website. If you force https, the css file doesn't make it. And you have a plaintext webpage.

[EEVblog]

Previous discussion, with input from gnif on why it was not done at the time:
https://www.eevblog.com/forum/chat/secure-version-of-the-forum/

[AntiProtonBoy]

Have you done this ?

Yes.

I'd most likely quit if the forum moved to HTTPS.  (Not a great loss perhaps.)  Old browsers don't really handle currently popular encryption standards well, and the defaults in most places seems to be very particular about who's allowed to connect.  I'm already having to manually change all URLs to "http:" on the non-forum EEVblog pages.

What on earth are you using? Netscape Navigator Gold? IE6 or something?

The whole "Ooh! Let's encrypt all the things!" push is pointless, and that's coming from someone intensely angry about surveillance and privacy issues (specifically, the lack of privacy).

The whole idea behind encrypting traffic is to make surveillance difficult. If you care about privacy, then you'd care about protecting data. Your stance is contradictory.

[Kjelt]

The only security it offers is if someone types in his password when connected to a public (fake)  internet AP and the owner has his login credentials. Although I still hope (have to check) that only the hash will be transferred not the password in the clear.
The only user where this will have serious consequences will be the admins. So as long as the admins do not use any public internet AP's to look at the forum it will be ok'ish I guess, still I also find it weird that anno 2016 a website does not support https, but indeed a lot of forums don't do this.

[rstofer]

 The whole idea behind encrypting traffic is to make surveillance difficult. If you care about privacy, then you'd care about protecting data. Your stance is contradictory.

Other than the 'pillowcase full of chad' approach to hiding stuff, what's the point?  Everything that is posted ultimately winds up as plaintext on the forum.  If the data is going to wind up as text on a srceen, it might as well be text during transmission.  Leaving it as plaintext takes a certain load off my computer.  Not a big load but compute cycles nevertheless.

My browser is fully capable of handing https but I don't see any reason for a forum like this to use it.

If I want privacy, I would disconnect from the Internet and pull the batteries out of my cellphone.

[hammy]

Everything that is posted ultimately winds up as plaintext on the forum.  If the data is going to wind up as text on a srceen, it might as well be text during transmission. [...] Leaving it as plaintext takes a certain load off my computer. [...]

No, there are private messages inside this forum about reverse engineering scopes and firmware. Some people are from countries with laws against this. Even the metadata about these conversaitions is precious.
If some people don't see a reason for this ... it does not mean there is no reason at all for other people.
If some people don't want to use SSL because of the load on their cpu ... they are free to connect without ssl.
But for some people there is a valid reason to encrypt the connection for their privacy!

Cheers
hammy

[Kjelt]

The load on their cpu?
 
Only the TLS handshake takes some processing power because it is assymetrical, that is once per connection.
After that the entire encryption/decryption algo's are symmetrical and take <1% of any modern CPU after 2005.

[magetoo]

What on earth are you using? Netscape Navigator Gold? IE6 or something?

An older version of Opera (using the old rendering engine); it's fast on a slow machine and pretty low on resource use.  It does HTTPS just fine, just not with all the most recent encryption.

The problem is that some sites are set up to refuse using older, less secure variants of HTTPS, so I end up switching to plain HTTP despite both ends supposedly supporting encryption.  (And of course there's no way to have it use OpenSSL, which has all the crypto bells and whistles.  The irony is that the ancient "links" browser does.)

[madires]

The only security it offers is if someone types in his password when connected to a public (fake)  internet AP and the owner has his login credentials. Although I still hope (have to check) that only the hash will be transferred not the password in the clear.
The only user where this will have serious consequences will be the admins. So as long as the admins do not use any public internet AP's to look at the forum it will be ok'ish I guess, still I also find it weird that anno 2016 a website does not support https, but indeed a lot of forums don't do this.

There are much more reasons for https. Another one might be your ISP. Some ISPs do some very nice things like replacing or inserting ads on the fly on the web pages you read. SSL makes it harder for them. The Internet isn't a cozy place like 25 years ago, it's a fish tank full of hungry sharks and other fish looking for some easy meal.

[Kjelt]

You mean tracking cookies? An ISP i am not worried about. With or without tls if the forum is infected with some script hidden in some content you be screwed if your malware scanner does not recognize it.

[AntiProtonBoy]

You mean supercookies? Yeah. Some ISPs like Verizon is literally injecting data into the HTTP stream. There is really not a lot you can do, unless you're accessing a site that supports HTTPS, or if you're use a VPN. It's fucked.

http://webpolicy.org/2014/10/24/how-verizons-advertising-header-works/

[madires]

You mean tracking cookies? An ISP i am not worried about. With or without tls if the forum is infected with some script hidden in some content you be screwed if your malware scanner does not recognize it.

Not just tracking cookies. Such an ISP could replace the TI ad I'm seeing right now with an ad for blue pills, for example. So Dave would get less revenue, in case of pay per click. Yes, if someone finds a CSS or SQL injection vulnerability in the forum's software, SSL/TLS doesn't help. But it helps, when the ad your ISP inserts contains malware. This is not a theoretically attack, it already happened several times.

[orin]

You mean tracking cookies? An ISP i am not worried about. With or without tls if the forum is infected with some script hidden in some content you be screwed if your malware scanner does not recognize it.

Not just tracking cookies. Such an ISP could replace the TI ad I'm seeing right now with an ad for blue pills, for example. So Dave would get less revenue, in case of pay per click. Yes, if someone finds a CSS or SQL injection vulnerability in the forum's software, SSL/TLS doesn't help. But it helps, when the ad your ISP inserts contains malware. This is not a theoretically attack, it already happened several times.

Good point.  SSL/TLS establishes a level of trust that what you are seeing in your browser is what was served by the forum.  With plain http, you cannot trust any link posted since a MITM attack or as you say, an ISP, can replace it at will.  But there will be the response that you should check that links aren't pointing somewhere malicious.  Sure, but what about tinyurl and similar links.  What about the link that was OK yesterday or last week? 

For this reason, I'd support end to end HTTPS for the forum.

[FlyingHacker]

You mean you guys don't see the ads for blue pills on EEVBlog forum? 

Seriously, I am all in favor of it for both making it more difficult for the knuckleheads in Utah to read, as well as prevent injection of ads/malicious code/tracking tools.

[EEVblog]

The load on their cpu?
 
Only the TLS handshake takes some processing power because it is assymetrical, that is once per connection.
After that the entire encryption/decryption algo's are symmetrical and take <1% of any modern CPU after 2005.

This server database handles about half a million connections per hour.

[forrestc]

The load on their cpu?
 
Only the TLS handshake takes some processing power because it is assymetrical, that is once per connection.
After that the entire encryption/decryption algo's are symmetrical and take <1% of any modern CPU after 2005.

Please look at he chart which says "Server Impact" on this website:  http://scn.sap.com/community/netweaver/blog/2013/06/23/whos-afraid-of-ssl

Note that moving from 'plaintext to SSL all-new resulted in nearly 3x the cpu load'.   They gloss over this by saying that 'well it's really only 5% of total usage on a core'. 

The concept that SSL has minimal impact simply isn't true in every case.  It is definitely true that in many cases anymore it's as simple as 'turning it on', since web servers tend to be lightly loaded CPU-wise and/or have encryption processors in them which minimize the load - or the load mix is such that the contribution of SSL isn't going to be enough to worry about it.   On the other hand, the idea that you can take a busy server which is spending a lot of it's CPU just providing pages and just turn on SSL without understanding the performance impact is dangerous and wrong.  I don't have enough knowledge about the backend hardware of the eevblog to say whether this is the case or not.... but at the point you're having to tune things to make them actually perform well enough to work on the hardware you have, adding something like SSL isn't something you can take lightly.

[Galenbo]

The whole idea behind encrypting traffic is to make surveillance difficult. If you care about privacy, then you'd care about protecting data. Your stance is contradictory.

Some people don't believe in "privacy on internet" , maybe because every country is logging everything by their local variant of NSA.
SSL, TLS, or whatever other "technology", is either invented or tolerated by those organisations.

Another big hit are those "anonymous browsers" that are developed and put on torrent by "some organisation"
That's the work of the Maffia or NSA. Some people believe that's the same.

Privacy=data on a disk, in a computer without network.

[madires]

Please look at he chart which says "Server Impact" on this website:  http://scn.sap.com/community/netweaver/blog/2013/06/23/whos-afraid-of-ssl

Note that moving from 'plaintext to SSL all-new resulted in nearly 3x the cpu load'.   They gloss over this by saying that 'well it's really only 5% of total usage on a core'. 

Since it's software written by SAP, we can assume it's a worst case scenario

The concept that SSL has minimal impact simply isn't true in every case.  It is definitely true that in many cases anymore it's as simple as 'turning it on', since web servers tend to be lightly loaded CPU-wise and/or have encryption processors in them which minimize the load - or the load mix is such that the contribution of SSL isn't going to be enough to worry about it.   On the other hand, the idea that you can take a busy server which is spending a lot of it's CPU just providing pages and just turn on SSL without understanding the performance impact is dangerous and wrong.  I don't have enough knowledge about the backend hardware of the eevblog to say whether this is the case or not.... but at the point you're having to tune things to make them actually perform well enough to work on the hardware you have, adding something like SSL isn't something you can take lightly.

Of course, you shouldn't just enable https. You have to do your homework first, e.g. which SSL/TLS versions to support and which chiphers. There are several ways to improve the SSL performance. More food for thought and some hints:
- https://www.keycdn.com/blog/https-performance-overhead/
- https://unhandledexpression.com/2013/01/25/5-easy-tips-to-accelerate-ssl/

[Kjelt]

Please look at he chart which says "Server Impact" on this website:  http://scn.sap.com/community/netweaver/blog/2013/06/23/whos-afraid-of-ssl
Note that moving from 'plaintext to SSL all-new resulted in nearly 3x the cpu load'.   They gloss over this by saying that 'well it's really only 5% of total usage on a core'.   

They use a very weird TLS scheme:

“All-new” SSL. The connection with the server is closed after each request, meaning a new SSL handshake needs to be performed for every request.

This is not how normal TLS schemes work, perhaps for ultra secure banking transactions you might do this but for 99,99% of all TLS traffic after the initial handshake you can sent and receive 4GB of data before you want to renegotiate and even more is possible before there is a security risk.

[AntiProtonBoy]

Some people don't believe in "privacy on internet" , maybe because every country is logging everything by their local variant of NSA.
SSL, TLS, or whatever other "technology", is either invented or tolerated by those organisations.

Another big hit are those "anonymous browsers" that are developed and put on torrent by "some organisation"
That's the work of the Maffia or NSA. Some people believe that's the same.

So, if NIST helps security agencies to develop crypto, they should be automatically dismissed? It doesn't matter who invents what. The aforementioned algorithms, code, and mathematics are out there for anyone to scrutinise, peer review and put to the test. If it has engineered flaws, it will be found (as is the case with dodgy elliptic curves, such as Dual_EC_DRBG).

Surveillance agencies are just as interested in protecting their own data as anyone out there. And they develop technology that is capable of doing that. And the best security is the kind where you can publish details how it works and the protection is actually offered by the mathematics. Makes little sense for those agencies to use back door-ed crypto that put themselves at risk.

[System Error Message]

I've discussed this topic before on a networking forums. you only need https to authenticate yourself such as when logging in, otherwise it creates unnecessary load. Whats the point of https on an information site? You're not trying to hide data.

the SSL but for https takes a lot of CPU on a server to handle a few Gb/s of throughput, so this being a site for sharing information is totally pointless for https. Only user authentication needs it.

Unless your forum is secretive and so on no https is needed.

[hammy]

Whats the point of https on an information site? You're not trying to hide data.

No, there are private messages inside this forum about reverse engineering scopes and firmware. Some people are from countries with laws against this.

http://motherboard.vice.com/read/google-chrome-shaming-http-unencrypted-websites-january

Cheers
hammy