Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

This kind of implies that HTTPS is secure. :) I dont think there is anything wrong using HTTP internally in a datacenter for data that is not sensitive (like monitoring, statistics, etc.). I guess you can still access these in legacy mode. I think the title should be that HTTP is getting phased out for public internet use or something.


actually, its not really "safe behind a firewall"

what if im inside the network i tell your monitoring that everythings ok while i break stuff?


and how is HTTPS protecting us against that? if you took over that IP address you can initiate a valid HTTPS session using the compromised server's identity and communicate with the monitoring service happily reporting fake data over HTTPS. I don't see your point. The question here is btw. is it worth X amount of dollar to protect this service with a secure channel? Sometimes the answer is yes, sometimes it is no.


the internal server is always made of servers and clients just like the external one. if you compromise one server you have access to the data transiting there, but not the others

if you compromise one client you have access to the data this client sends only

in particular, very few internal networks enforce L2 security (ie its possible to sniff all data on the same VLAN as you are).




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: