Get a cert

robinbowes

Hey admino,

Why you no use tls/ssl?

It takes 5 mins to get an auto-renewing cert with Let's Encrypt.

I can help.

R.

monquixote

Good idea.

We'll add it to the list for the next hack day.

TTony

monquixote said:

We'll add it to the list for the next hack day.

Do we need to wait for that - seems like this would be a quick/easy fix to do in-flight?

digitalscream

This did occur to me, but I have a couple of problems with it:

1 - It wouldn't really add anything useful.

2 - People are always embedding images here, which aren't necessarily from an https:// source, so the browser will chuck an exlamation mark on the basis that the page is secure but the content mixes secure and non-secure content.

3 - It can cause issues with Javascript, and we have enough of those problems already

robinbowes

digitalscream said:

This did occur to me, but I have a couple of problems with it:

1 - It wouldn't really add anything useful.

Yeah, because securing cookies and authentication is not useful at all?

R.

digitalscream

robinbowes said:

digitalscream said:

This did occur to me, but I have a couple of problems with it:

1 - It wouldn't really add anything useful.

Yeah, because securing cookies and authentication is not useful at all?

R.

The encryption value of SSL/TLS is pretty much insignificant; it's easily cracked with the right tools. It's more about verifying the identity of the site you're dealing with.

robinbowes

digitalscream said:

The encryption value of SSL/TLS is pretty much insignificant; it's easily cracked with the right tools. It's more about verifying the identity of the site you're dealing with.

*boggle*

So, you'd use online banking without TLS?

R.

digitalscream

robinbowes said:

digitalscream said:

The encryption value of SSL/TLS is pretty much insignificant; it's easily cracked with the right tools. It's more about verifying the identity of the site you're dealing with.

*boggle*

So, you'd use online banking without TLS?

R.

No, because I want to be sure that the site at the other end is the one I was intending to visit

digitalscream

In any case, my point is that it's not a simple case of buying a cert and attaching it to the domain; there's a high likelihood that it can break other stuff (particularly active and embedded content), which means there's an awful lot of testing (and, given the code we're dealing with, probably redevelopment) to be done beyond just sticking a cert on the site. It's a question of priorities - given the other stuff we need to deal with in order to fix and add functionality that people want, is it worth getting a cert in order to (at best) get a "mixed content" message in the browser?

robinbowes

Fair point, and worth due consideration, but I think any site that has logins should use TLS and deal with the wrinkles.

R.

TTony

Sounds like you've got some knowledge/experience on the subject @robinbowes - fancy getting stuck in and helping to work out how to deal with the "wrinkles"?

robinbowes

TTony said:

Sounds like you've got some knowledge/experience on the subject @robinbowes - fancy getting stuck in and helping to work out how to deal with the "wrinkles"?

I am, yes. I've offered before

R.

robinbowes

Here's why we use TLS and HSTS:

http://arstechnica.co.uk/security/2016/11/meet-poisontap-the-5-tool-that-ransacks-password-protected-computers/

digitalscream

Just so you're aware, this won't be happening any time soon. I tried it locally at the weekend, and it breaks the Javascript integration with basically everything.

robinbowes