Timeline for Is HTTPS required for local network server to server communication
Current License: CC BY-SA 4.0
24 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 11, 2020 at 11:10 | comment | added | Criticizing Israel not allowed | @Michael Well, it closed that attack vector. Now the NSA has to do riskier stuff, like sneaking extra chips into their servers (conjecture). | |
| Mar 11, 2020 at 8:42 | comment | added | Voo | @Matthew I've used HTTP/2 without HTTPS without problems. Browser vendors just decided to not support it, but there's nothing in the spec that forbids that combination. | |
| Mar 10, 2020 at 21:10 | comment | added | Michael | @user253751 But did it help? | |
| Mar 10, 2020 at 18:24 | vote | accept | asinkxcoswt | ||
| Mar 10, 2020 at 10:31 | comment | added | James_pic | Probably not worth an answer in its own right, but the ServerName for the VirtualHost should be whatever name you'll put in the URI you use to connect to the server - whether that's an IP address or a hostname. If you're signing certificates with an internal CA (which I'd recommend anyway), then you can use either hostnames or IPs as subject alt names, so there's no trouble getting a cert for that name (public CAs are fussier about certs for IPs, but you won't have that problem if you're managing it internally). | |
| Mar 9, 2020 at 22:59 | comment | added | Qwertie | @Matthew iirc there is no reason you can't use http2 without TLS if you control the server and client. | |
| Mar 9, 2020 at 20:59 | answer | added | Mike Robinson | timeline score: 0 | |
| Mar 9, 2020 at 18:55 | comment | added | Matthew | Aside from security, there's also performance reasons to use HTTPS. For example the use of H/2 (instead of HTTP/1.1), which the AWS ALB supports by default. | |
| Mar 9, 2020 at 18:17 | answer | added | fraxinus | timeline score: 3 | |
| Mar 9, 2020 at 13:35 | answer | added | Peteris | timeline score: 8 | |
| Mar 9, 2020 at 11:12 | comment | added | Criticizing Israel not allowed | Google used to not use HTTPS internally. Then, Snowden let everyone know that the NSA had attached extra stuff to Google's system so that the NSA could see all the traffic. Now Google uses HTTPS internally. This slide here: businessinsider.com/… | |
| Mar 9, 2020 at 4:27 | comment | added | Moo | Google used to have no encryption on traffic within its data centres - and then it came to light that there was a very high probability that state actors were reading that data, so Google moved to encryption everywhere... | |
| Mar 8, 2020 at 21:00 | history | tweeted | twitter.com/StackSecurity/status/1236758666868555777 | ||
| Mar 8, 2020 at 20:13 | history | became hot network question | |||
| Mar 8, 2020 at 18:11 | answer | added | symcbean | timeline score: 8 | |
| Mar 8, 2020 at 14:05 | answer | added | Serge Ballesta | timeline score: 5 | |
| Mar 8, 2020 at 13:48 | answer | added | Demento | timeline score: 48 | |
| Mar 8, 2020 at 13:13 | comment | added | Conor Mancone | Your comments about SSL certificates are just an implementation detail and are not really on topic here (although the rest is fine). Your job as a service provider is to figure out the cost of these changes so you can tell your client how much it will cost, and let them decide if it is worth it for their business. Right now it just sounds like you don't want to be bothered to take the effort, which is not really a reasonable approach. Now if these were changes being requested at the end of a release process that you won't be paid for then I would certainly refuse. | |
| Mar 8, 2020 at 13:10 | comment | added | Conor Mancone | Worth a google: zero-trust networks. You are correct that HTTPS is intended to allow secure communication in an insecure channel. You assume that your internal network is trustworthy. | |
| Mar 8, 2020 at 12:57 | history | edited | asinkxcoswt | CC BY-SA 4.0 |
deleted 92 characters in body
|
| Mar 8, 2020 at 12:36 | history | edited | schroeder♦ |
edited tags
|
|
| Mar 8, 2020 at 12:29 | history | edited | asinkxcoswt | CC BY-SA 4.0 |
deleted 1 character in body
|
| Mar 8, 2020 at 12:10 | review | First posts | |||
| Mar 8, 2020 at 15:51 | |||||
| Mar 8, 2020 at 12:09 | history | asked | asinkxcoswt | CC BY-SA 4.0 |