Hacker News new | ask | show | jobs
by kennet 5568 days ago
I have a silly, fictional view of the future: That every website will be HTTPS by default, and instead of Firefox/Chrome/etc using a "green" bar to tell a secure website, it will not say anything, but will display big red warnings when a website is not secure.
2 comments
jedsmith 5568 days ago
And we'll all have muscle memory to add the exception through the browser's four-step "I know what I'm doing" UI.
link
drzaiusapelord 5567 days ago
In Chrome and IE its one or two clicks. I don't know why people tolerate Firefox's silly "ZOMG THIS SSL CERT MIGHT BE WRONG" 90-click UI. Joe Averge is still going to run through the clicks. Badgering the user with more prompts has been shown to not increase security and only frustrate power users.
link
drzaiusapelord 5567 days ago
The problem is that there aren't enough IPv4 IP address for this. Each SSL cert requires an IP address. So if you have 200 sites on one virtual setup with one IP, only one of them can have the SSL. The connection needs to be established before Apache or IIS can be told what site to serve.

Maybe v6 will solve this, but right now you simply cannot do this. Or maybe the spec can be changed somehow (ask for host first then start SSL handshake?).

link
duskwuff 5567 days ago
> Or maybe the spec can be changed somehow (ask for host first then start SSL handshake?).

SNI does exactly this. Sadly, MSIE doesn't support it under Windows XP (and earlier), so we have to live without it for a while longer.

link