3 ms·

The indirect costs of switching to HTTPS (like lost advertisement revenue) make it a inviable solution. How does HTTPS result in lost ad revenue?

by jey 10y ago

erk__ 10y ago
Hackernews thread from yesterday: https://news.ycombinator.com/item?id=11803716 https://news.ycombinator.com/item?id=11803716
prohor 10y ago
https://news.ycombinator.com/item?id=11803716 https://news.ycombinator.com/item?id=11803716
revelation 10y ago
The answers here are off the mark. You can obviously have the update channel use HTTPS and keep your website at HTTP (not recommended, but certainly possible). Or just sign the updates and version information.
- pfg 10y ago
  The way the update system works (according to the article) is that it shows a pop-up with the new version, and that pop-up opens their site (via HTTP). It is conceivable that they'd rely on the impressions coming from update dialogs for their ad revenue, so the argument they used (which - just to clarify - is not my argument) would apply here as well. Switching to HTTPS (or some other signing mechanism) for the update check would solve one of the problems described in the article (tricking the user into thinking there's a new version available), but it would not eliminate the MitM opportunity on the site itself.
  - stcredzero 10y ago
    The MitM on the automated update check is by far more dangerous.
- SignalsFromBob 10y ago
  He has fixed it and is signing the version info file.
teleclimber 10y ago
So wait, so this project that I use to store my passwords and that always seemed to take security and encryption seriously is leaving a public vulnerability unfixed because of "lost ad revenue"?? I'm baffled. I completely understand the need to support the project financially, but this answer leaves me feeling very uncomfortable.
vintageseltzer 10y ago
1. Many ad networks do not support serving over HTTPS. 2. Serving HTTP ads only your HTTPS-only site will show scary mixed-content warnings in many browsers, driving away users.

The indirect costs of switching to HTTPS (like lost advertisement revenue) make it a inviable solution. How does HTTPS result in lost ad revenue?

by jey 10y ago

The indirect costs of switching to HTTPS (like lost advertisement revenue) make it a inviable solution. How does HTTPS result in lost ad revenue?

erk__ 10y ago

Hackernews thread from yesterday: https://news.ycombinator.com/item?id=11803716 https://news.ycombinator.com/item?id=11803716

prohor 10y ago

https://news.ycombinator.com/item?id=11803716 https://news.ycombinator.com/item?id=11803716

revelation 10y ago

The answers here are off the mark. You can obviously have the update channel use HTTPS and keep your website at HTTP (not recommended, but certainly possible). Or just sign the updates and version information.

pfg 10y ago
The way the update system works (according to the article) is that it shows a pop-up with the new version, and that pop-up opens their site (via HTTP). It is conceivable that they'd rely on the impressions coming from update dialogs for their ad revenue, so the argument they used (which - just to clarify - is not my argument) would apply here as well. Switching to HTTPS (or some other signing mechanism) for the update check would solve one of the problems described in the article (tricking the user into thinking there's a new version available), but it would not eliminate the MitM opportunity on the site itself.
- stcredzero 10y ago
  The MitM on the automated update check is by far more dangerous.
SignalsFromBob 10y ago
He has fixed it and is signing the version info file.

teleclimber 10y ago

So wait, so this project that I use to store my passwords and that always seemed to take security and encryption seriously is leaving a public vulnerability unfixed because of "lost ad revenue"?? I'm baffled. I completely understand the need to support the project financially, but this answer leaves me feeling very uncomfortable.

vintageseltzer 10y ago

1. Many ad networks do not support serving over HTTPS. 2. Serving HTTP ads only your HTTPS-only site will show scary mixed-content warnings in many browsers, driving away users.