E
Eric Mill
konklone.com · Personal blog · on HN since 2012
Eric Mill, a US government technologist, writes about HTTPS adoption, web security, and tech company policies.
What HN saysHN commenters link his posts on HTTPS, SHA-1 deprecation, and Slack's arbitration policy, and use them to explain connection integrity attacks like ISP injection.
34HN people shared it
23linked it in comments
19stories submitted
2.3Kstory points
5 years agolast shared
2012people per year2026
Most-shared posts
- 1Switch to HTTPS Now, For Free5 people · 640 points · first shared 2013 · 251 comments on HN
- 2Slack's New Arbitration Policy5 people · 317 points · first shared 2014 · 113 comments on HN
- 3We're Deprecating HTTP and It's Going to Be Okay5 people · 8 points · first shared 2015 · 1 comments on HN
- 4Why Google is Hurrying the Web to Kill SHA-13 people · 423 points · first shared 2014 · 131 comments on HN
- 5Quora Keeps the World's Knowledge for Itself3 people · 305 points · first shared 2014 · 123 comments on HN
- 6Dropbox Bug Can Permanently Lose Your Files3 people · 193 points · first shared 2012 · 146 comments on HN
- 7GitHub Pages Now Supports HTTPS, So Use It3 people · 2 points · first shared 2014 · discussion on HN
- 8Github pages now sorta supports https so use it3 people · first shared 2015
- 9How to Hack the Developer Console to be Needlessly Interactive for Christmas2 people · 78 points · first shared 2013 · 14 comments on HN
- 10The lesson of n_is_stolen is to use 2FA for your domain name2 people · 1 points · first shared 2014 · discussion on HN
- 11The Door To The FISA Court Doesn't Even Have A Sign On It1 people · 273 points · first shared 2013 · 56 comments on HN
- 12The Making of isitchristmas.com 20121 people · 6 points · first shared 2012 · discussion on HN
- 13Webfinger Gets a Final Chance1 people · 3 points · first shared 2013 · discussion on HN
- 14Take Control of Your Email Address (2013)1 people · 2 points · first shared 2014 · discussion on HN
- 15Get a FIDO key right now and log into stuff with it1 people · 1 points · first shared 2014 · discussion on HN
What HN people wrote when they linked it
konklone · 2017-01-02
It's just basic connection integrity -- without HTTPS, there's no guarantee the user is actually getting the content that the site meant to send, and vice versa. Those kind of attacks really do happen, and at scale (e.g. Verizon XUID, or China's Great Cannon).
If it's at all interesting, I laid out in detail, with examples, why I've been comfortable taking a very hard line on deprecating HTTP:
https://konklone.com/post/were-deprecating-http-and-its-going-to-be-ok…
drvdevd · 2016-11-26
It's interesting to think of it this way. Clearly, the attackers (being ISPs in this case) don't see it this way or don't want to see this sort of MITM this way. Following one of the links in the article [1], you get some great quotes:
> Comcast injects ads into unencrypted traffic, because "it's a courtesy, and it helps address some concerns that people might not be absolutely sure they're on a hotspot from Comcast".
So maybe someone out there actually feels this way when they find content has been directly injected in their unencrypted browsing session. I sure don't.
[1] https://konklone.com/post/were-deprecating-http-and-its-going-to-be-ok…
sinak · 2014-11-24
Eric Mill's excellent post about Slack's new arbitration clause was just merged into this thread by the moderators. Here is the URL:
https://konklone.com/post/slack-is-now-forcing-users-into-arbitration-…
The post is titled "Slack is now forcing users into arbitration and that is terrible." I highly recommend reading it, as there's no mention of the arbitration ToS change in Slack's own blog post.
Edit: Also worth reading the ongoing conversation between Stewart Butterfield (Slack CEO) and Konklone on Twitter: https://twitter.com/stewart/status/536975596920635393
kmfrk · 2014-08-07
This is great, but it should also be a reminder that SSL is currently not possible for custom domains hosted on GitHub: https://konklone.com/post/github-pages-now-supports-https-so-use-it#us…
I hope a solution materializes eventually.
Grollicus · 2021-08-18
Hashes are generally a part of the signature generation used with certificates. See for example "What role do hashes play in TLS/SSL certificate validation?" -> https://security.stackexchange.com/questions/67512/what-role-do-hashes…
In certificates, md5 - and sha1 - was used quite some time after it was known to be weak, I suspect OP was thinking of that.
This article seems to give a good summary what happened with sha1, mentions md5 in passing and links the related chromium issue: https://konklone.com/post/why-google-is-hurrying-the-web-to-kill-sha-1
int_19h · 2020-05-13
> Have I missed a memo that HTTP is going away?
https://konklone.com/post/were-deprecating-http-and-its-going-to-be-ok…
(FWIW, I personally don't like it and think that it's a mistake.)
cjbprime · 2018-12-27
cooper12 · 2016-12-28
The interesting thing about Quora is that it has a lot of personal anecdotes directly from people involved. That's really unfortunate considering all the dark patterns and user hostile design the site utilizes. Along with their registration paywall, they also do other things to hoard all that user-contributed knowledge: https://konklone.com/post/quora-keeps-the-worlds-knowledge-for-itself. Really disappointing, imagine if Stack Overflow was run this way. I hope this rant is on-topic enough considering that the post is just quoting a Quora source and if Quora ever shuts down or fully hides itself, these kinds of posts will be all that we have of the knowledge shared by these experts.
tedmiston · 2016-12-21
I don't think this is correct for GitHub Page sites that use custom domains. See [1] and [2].
[1]: https://konklone.com/post/github-pages-now-supports-https-so-use-it
[2]: https://github.com/isaacs/github/issues/156
jdietrich · 2016-11-17
The fault in that case lies entirely with GoDaddy's poor security. Use a competent registrar, preferably one that supports 2FA with a hardware token.
https://konklone.com/post/protect-your-domain-name-with-two-factor-aut…
franciscop · 2016-06-09
So now github "sorta sorta" [1] supports https:
- You CAN force HTTPS for your *.github.io site.
- You CAN use an https://yourname.github.io URL.
- You CANNOT use a custom domain name with a fully secured HTTPS connection.
[1] https://konklone.com/post/github-pages-now-sorta-supports-https-so-use…
bluetidepro · 2016-04-05
toomuchtodo · 2015-08-21
https://konklone.com/post/switch-to-https-now-for-free
Third Google result for "How to switch my site to https"
cben · 2015-05-30
There already kinda is TLS on github.io but it's only user<->CDN, CDN<->Github is unencrypted.
[https://konklone.com/post/github-pages-now-sorta-supports-https-so-use…
And it doesn't work on custom domains (Github can't present a cert for your domain); you can make it "work" via Cloudflare but that only works if Cloudflare doesn't validate Github's cert, which introduces yet another unsecure link. [https://github.com/isaacs/github/issues/156]
mbreese · 2014-11-24
You're not missing anything. Two posts were merged. This is the Privacy policy blog post by Slack. There was another blog post (third-party) that talked about changes in their TOS to include arbitration.
https://konklone.com/post/slack-is-now-forcing-users-into-arbitration-…
wdewind · 2014-11-24
> opting out of complying with any legal system by forcing an arbitration clause on its customers.
I don't fully understand the context. Can you explain the arbitration clause they are forcing?
Edit: Found this, also on the front page right now: https://konklone.com/post/slack-is-now-forcing-users-into-arbitration-…
opendais · 2014-11-04
They use 128bits of a SHA-1 key in 2014. I'd say its pretty clear their security is a gimmick only.
https://konklone.com/post/why-google-is-hurrying-the-web-to-kill-sha-1
From the contest:
"This can happen if a security check is failed, or in the case that the first 128 bits of the SHA-1 of the newly created encryption key don‘t match on both parties’ clients when this stage is completed (this corresponds to Paul and Nick comparing the key visualizations for the Secret Chat in their Telegram apps)."
jipy9 · 2014-03-25
I used StartSSL class 1 certificate for my app (unherd.co). Its free and valid for one year. Here is a good guide that might be of help - https://konklone.com/post/switch-to-https-now-for-free?hn
zxcvgm · 2013-11-08
Why would anyone use this when startssl.com issues free certs that are not only limited to OSS projects?
See https://konklone.com/post/switch-to-https-now-for-free?hn for a walkthrough.
csomar · 2013-05-25
Author here: I'm not using DropBox for backups. I have a relatively slow connection to do that. I'm using DropBox for files that I need to be available on different computers/tablets...
I'm not blaming DropBox for not keeping an unlimited history (it's obviously my fault), I just believe that they should have taken the Client bug more seriously.
Someone else appearantly had this issue: http://konklone.com/post/dropbox-bug-can-permanently-lose-your-files
bitcartel · 2012-10-29
Dropbox bug which results in data loss has not been resolved yet. So far it appears to have affected both Mac and Linux users.
http://konklone.com/post/dropbox-bug-can-permanently-lose-your-files
jfaucett · 2014-08-06
I think it depends on what you're comparing the current system with, right? I mean sure if its either no hoop jumping or you have to pay some money then you can go figure ok the person willing to give up bucks and go through the trouble is probably a little more reliable because of that. But how is that type of system ideal or secure? Currently, ssl certs give me very little assurance that any data over the connection is not being backdoored/sniffed to whomever, that the private certs arent compromised, etc. I think we shouldn't be trusting people because of hoops they go through, but because the system we use doesnt allow fraudelent players to stay in the game. Personally, I'd like to see it head in this direction:
https://github.com/okTurtles/dnschainhttps://github.com/okTurtles/dnsc…
also for some more background on some concerns with CAs see: https://konklone.com/post/certificate-authorities-are-actually-a-treme…
pixl97 · 2017-04-12
https://mobiforge.com/news-comment/no-https-then-bye-bye-geolocation-i…
https://www.wordfence.com/blog/2017/01/chrome-56-ssl-https-wordpress/
https://blog.mozilla.org/security/2015/04/30/deprecating-non-secure-ht…
http://stackoverflow.com/questions/32106849/getcurrentposition-and-wat…
https://konklone.com/post/were-deprecating-http-and-its-going-to-be-ok…
http://forums.whirlpool.net.au/archive/2598616
Just some random places to start to see why the major web browsers are not going to spend any time on non-encrypted protocols. A lot of devs need to help themselves and move to encrypted to connections before they are forced at browser-point.