4 ms·
Most shared hosting accounts charge extra for a dedicated IP address, both for setup and on a monthly basis. Don't underestimate how many blogs, churches, smal
by bcg1 11y ago
Most shared hosting accounts charge extra for a dedicated IP address, both for setup and on a monthly basis. Don't underestimate how many blogs, churches, small businesses, etc still use services like that.
To be fair, many of those sites probably ARE insecure, but it seems to be a little bit overkill to "shame" them for not implementing encryption.
- schoen 11y agoYou only need a dedicated IP address for clients that don't support SNI. If your hosting model supports it, you can also still support these clients with a single IP address with a SAN cert that includes all of the possible hostnames.
- JoshTriplett 11y agoSSL hasn't required a separate IP since Windows XP. And XP no longer has any security support, so anyone running it has bigger problems.
- bcg1 11y agoGuess you're right, fair enough. I still don't agree with putting a scarlet letter on these types of sites though.
- JoshTriplett 11y agoNothing short of that will get HTTPS adoption to approach 100%. Many people have commented that it seems odd to complain about broken HTTPS but not about HTTP; I agree with that. As long as browsers show unencrypted HTTP as "neutral" rather than "bad", far too many sites simply won't care. This has been a long and gradual step, but it needs to happen for HTTP to finally go away.
- airswimmer 11y agoHTTPS is rather more secure than what HTTP is. Because it creates a relative secure tunnel between the client and host. But HTTPS does not mean 100% secure, it's easy to be hacked by MITM or traffic been spied. I think that getting rid of HTTP should not be shamed in that way. But google is planning on doing this thing. Just as someone said, MITM attackers can switch google ads to others, and I think this is the reason why Google wants to shame those sites who use Google Ads and not use HTTPS. Google can make an increasing revenue by this act. And yet HTTP2 is out, will google shame those sites who only support HTTP1.0/HTTP1.1 ? I don't think so. Because this has almost nothing to do with revenue for Google.
- JoshTriplett 11y ago> But HTTPS does not mean 100% secure, it's easy to be hacked by MITM or traffic been spied. I don't know what properties you think HTTPS lacks here, but no, HTTPS doesn't allow "easy" MITM or eavesdropping. If you want to break HTTPS, you either need to compromise an endpoint, or pressure an accepted certificate authority to risk destroying their entire business by issuing a fraudulent certificate.
- unicornporn 11y agoI have shared hosting at Dreamhost. Installing Let's Encrypt certs was a two click procedure. I guess more hosting companies will follow.
- airswimmer 11y agoThis looks cool. It seems dreamhost did a good job.
- pmlnr 11y agonginx + TLS, and TLS is many-certs-same-IP friendly from the start. SSL is insecure already anyway.