Project page | Talk | Edit | History  

WorldWideWiki:Secure

From the World Wide Wiki

"Well once I was young and impulsive.

     I wore every conceivable pin,
 Even went to the socialist meetings,
     And I knew all the old union hymns.
 But I've grown older and wiser,
     And that's why I'm turning you in!
 So love me, love me, love me...I'm a liberal!"
          -Phill Ochs, "Love Me, I'm a Liberal"


Jump to: navigation, search

Okay, so I've got the SSL module running the webserver hosting this site, which means you can access it via the HTTPS ("Secure HTTP") protocol. This is basically an SSL/TLS security layer sitting on top of the normal HTTP web protocol. What this means, in theory, is that there's a "tunnel" between your web browser, and my server, and all the communications go through this tunnel. The "tunnel" is a common networking term meant to illustrate that there's something "opaque" surrounding your communications channel so that only the people on either end can see inside. Of course, it's not a real tunnel, it's a pretty powerful encryption scheme that encodes the data on one end, and decodes on the other: and in between, it doesn't like anything comprehensible.

So that's the gist of what the HTTPS protocol is about: but there's quite a bit to qualify in terms of this particular site. First of all, not everything on every page comes through HTTPS. For instance, some pages may include some scripts and/or images from other sites, like wikipedia. So the main HTML page fetched by your client includes resources from these other sites, like with <img> tags, CSS, and Javascripts, etc. When your web browser parses the HTML page, it will see these resources and go off to fetch them. If those resources aren't from an HTTPS address—most probably won't be—then your browser will fetch it unencrypted, without any SSL or TLS protection.

In this case, your browser will probably complain, perhaps silently with some kind of icon. For instance, in Firefox, the address bar, which is normally yellow for a secure connection, will go back to white, and the pad lock icon on the right side of the address bar will have a line through it. If you click on the icon, you should be able to get information, indicating the problem: some of the content wasn't encrypted.

Secondly, HTTPS is not just about encrypting the connection (that's the tunnel part), but also verifying that the server is who they claim to be. For instance, when you want to log into your bank's website you want to make sure it's really your bank, and not someone else intercepting your communications and sending back a fake site to get your information. So this is a whole public key cryptography thing, but it basically involves a certificate that I send to your browser when you connect with HTTPS, which is supposed to be "signed", or verified, by a trusted party. However, I don't particularly care if I am who you think I am, or not: if you want to send me your credit card number and PIN, then it's fine by me if it ends up on someone else's site, too. So what I'm getting at is that my certificate isn't signed, and your browser will most likely complain about this with some kind of dialog box. So once again, this warning tells you that no one except the site you're connecting to can vouch for...the site you're connecting to. So just accept that, and move on, you're still doing better than with regular HTTP.

Lastly, if you're using the "secure" connection to this site to hide what you're doing from some big-brother type entity (like you school or work's IT department), note that DNS requests are not covered by the SSL/TLS security layer. DNS is what your computer uses to find the IP address for the domain name you're trying to connect to. So when you connect to https://bmearns.net, before you even get to the HTTPS part of the communication, your browser needs to know how to get to bmearns.net. So it's going to send a request to a DNS server, asking for the the ip address for that domain. That means your overlord can still at least see what sites you're connecting to, even if it doesn't know what you're doing there. Additionally, all offsite resources a site contains (like images and scripts) will also require a DNS lookup for that site, which will also be unencrypted.

Okay, so given those issues, what's the point of having the secure layer on this site? Well, it's basically like I described in the last paragraph: there's some clandestine force monitoring all your web activity, and you'd rather they not know every little thing you do, just connect up on HTTPS, and you're good to go.