5 ms·
No. Obviously less is wrong. Here is an example: login over HTTP deliberate because the site doesn't support HTTPS is definitely not less sensitive.
by yeukhon 11y ago
No. Obviously less is wrong. Here is an example: login over HTTP deliberate because the site doesn't support HTTPS is definitely not less sensitive.
- ryanlol 11y agoOf course, but there's a general expectation that stuff served over HTTP isn't sensitive. Breaking HTTPS where it's deliberately used is something that certainly deserves a warning.
- yeukhon 11y agoThat's true, but I think at some point HTTP should go away. The deprecation should happen. I think we need to get to state where HTTPS is HTTP and there is no "HTTPS" at all. Everyone can easily get a free certificate, and for commercial they can spend hundreds if they want to "prove" more. Like I said in another comment, I don't see a problem with sharing cat photos over HTTP. But if possible, https is definitely not going to hurt. But given most sites are HTTP, yes, probably going to hurt ranking. Old websites running on old CMS won't be able upgrade much. Simiarily, no one should be running FTP. It should SFTP, but setting up SFTP is pain in the ass with chroot and all that. Technology really need to made simpler. Speaking from an ops standpoint.
- girvo 11y ago> Of course, but there's a general expectation that stuff served over HTTP isn't sensitive. For us, sure. For the other 95% of the population, not really, which is why Google is doing this
- ryanlol 11y agoYeah, but I'm just explaining why warnings for mixed content are more important than for plain HTTP. I'm absolutely not arguing against such warnings for HTTP.
- nickik 11y agoHow is it so hard to understand that its not just about your information. A attacker can easly put in new elements that insentivise users to put in information, or to help identify him.