According to their latest blog post, Mozilla wants to drop support of HTTP in favor of HTTPS in the long run. In theory, that’s a good decision. Unencrypted web traffic is not even a good idea for websites that host purely public material. If a malicious person were to setup an open WLAN hotspot somewhere in the city, s/he could (among other things):
- Infect executable downloads on the fly with viruses.
- Replace banner ads.
- Try to get people to act on false information (think: fake stock exchange prices)
On an ISP level, the problem is even worse, as demonstrated by Verizon who got caught inserting tracking cookies into HTTP headers.
In practice, killing HTTP could be quite fatal. Pretty much every network printer and DSL router in the consumer market comes with a webinterface. They rarely speak SSL and typically don’t offer a an upgrade path. The far bigger problem than rendering the administrative interface of a lot of network devices inaccessible, though is that HTTPS in its current form is broken.
HTTPS relies on certificates to exchange keys between client and server. The stupid thing is: if you assume that an attacker might manipulate network traffic (and that’s the reason why you want to use encryption in the first place), then you have no reason to assume that this attacker wouldn’t manipulate certificates! So, how do you know if a certificate genuine? Well, you need confirmation from a trusted third party. In this case, “trusted third party” means that your web browser has (very!) long list of so called “certificate authorities” that may accredit certificates by “signing” them. In a nutshell “signing” means that you generate a “signing request”, containing your postal address, the domain of the website you want to protect and your public key. From this, the CA will produce a certificate that states that these three things belong together and to one of their registered customers. Unfortunately, this is where the trouble starts:
- To run a website, you don’t need a signature from a certificate authority. But without it, visitors get a huge and scary warning upon their first visit, so in order not to scare visitors away, you want your certificate to be signed. That costs money and since certificates expire, it costs money over and over again. A HTTPS only web is a commercial only web.
- You have to trust the CA to do their job and not to give a potential attacker a valid certificate for your website. By the way, becoming a CA is mainly a question of paying a handsome amount of money to browser vendors (that’s one of the reasons why Firefox has such a large list of trusted CAs).
- Have a look at what organizations Mozilla deems trustworthy (in Firefox: Edit|Preferences|Advanced|Certificates). You might be surprised to find carriers and network operators in that list. In other words: EXACTLY THOSE ENTITIES YOUR PREMISE TELLS YOU NOT TO TRUST!
So, HTTPS everywhere? Sure, count me in, but first set up a CA that is free for everyone to use and ensure that network operators can never become a CA or at least drop that big scary browser warning about untrusted certificates.
