5 ms·

> HTTPS has been around since 1996 A blog post about spending several years updating to a protocol that's been around for 2 decades and has been standard for f

by coltonv 10y ago

> HTTPS has been around since 1996 A blog post about spending several years updating to a protocol that's been around for 2 decades and has been standard for full sites for years. This makes me feel like anyone who has an account on BBC should be afraid of their security practices. Calling a plaintext password leak from BBC right now. EDIT: People are taking this comment more seriously than I intended. I don't actually think you should distrust BBC's security practices because of this, but I do feel that major websites should have side-wide SSL by now. It is clear that a lot of people below me disagree with that, that's okay, I'm glad I spawned a debate here.

blowski 10y ago
Calling FUD on your comment. It hasn't been "standard on full sites for years", and still isn't now. Only recently with the 'HTTPS everywhere' move has the idea that public sites with no authentication should support HTTPS. And even now, that's not a universally supported opinion, because of its effect on caching. The BBC has used HTTPS on pages with forms that submit secure data, as has been the historic standard. Moving a site as massive as the BBC, which spans multiple domains and subdomains and has millions of pages is a big task. Note how you can still see news articles from the late 90s at the same URL. So, yeah, I can understand why writing a blog post about it is worthwhile.
- coltonv 10y ago
  Can you point out some other major sites used by the general public which have spent the last few years without site-wide SSL to back up your claim?
  - blowski 10y ago
    I can do better than that - I can give you a report published by Google in March 2016 which listed lots of them. https://www.google.com/transparencyreport/https/grid/ https://www.google.com/transparencyreport/https/grid/ For example, the following are all in the world's top 100 websites and none of them support any form of HTTPS. The link includes quite a few more. * alibaba.com * ask.com * ask.fm * baidu.com * cnet.com * cnn.com * dailymail.co.uk * ebay.com * globo.com * go.com * goal.com * goo.ne.jp * imdb.com * live.com * mirror.co.uk * naver.jp * nytimes.com * onet.pl * pornhub.com * telegraph.co.uk * uol.com.br * weibo.com * wikia.com * wikihow.com * wp.pl * yahoo.co.jp * yelp.com * youporn.com
    - coltonv 10y ago
      That's scary honestly. Thanks for sharing at least.
  - vtlynch 10y ago
    Washington Post. Buzzfeed. The Guardian. New York Times still dosent have HTTPs.
    - gilgongo 10y ago
      Their traffic is too high for them to afford it (and probably wouldn't outweigh the SEO uplift)
      - coltonv 10y ago
        Can I ask you why you say it would be too high for NYT to afford it, when many companies with significantly more traffic have site-wide TLS?
        gilgongo 10y ago
        If your examples are Google or Amazon, then those have profits several orders of magnitude bigger than the likes of NYT.
      - yeukhon 10y ago
        I am actually -1 on this idea. They should be able to afford terminating SSL on the load balancer end. It doesn't change the architecture for as long as the load balancer terminates the traffic. Securing HTTPS internally is an expensive move. CPU wise has always been an argument (or more like an excuse). If your load balancer is doing computation other than forwarding requests and decryption SSL session, you should double check your architecture. If small startup will millions of views can sustain SSL traffic, why not NYT? Most their traffics are just serving static files and results are usually cached anyway. Instead, the burdens are on testing and developing the migration. For example, they'd have to inventory and edit everywhere they use http:// http:// (hardcoding the scheme in your front-end code) instead of //. Furthermore they have to support third-party ad networks deliver active scripts (like javascript) over HTTP. Having HTTP while on HTTPS will create mixed content warning and for active contents browsers will block these violations immediately, thus breaking the website. To me, the decision of not migrating to HTTPS because of infrastructure capacity is always a myth. Someone has to prove that with data.
  - gilgongo 10y ago
    MailOnline. SSL would just cost too much in Akamai billing. Otherwise they'd do it straight away for the SEO uplift.
- witty_username 10y ago
  > It hasn't been "standard on full sites for years", and still isn't now. I'd estimate about 75% of the time I'm on an HTTPS website. > The BBC has used HTTPS on pages with forms that submit secure data, as has been the historic standard. This is insecure as the HTTP page can redirect to a malicious HTTPS page from a different domain.
  - blowski 10y ago
    I agree with the need for the BBC to do this. But I disagree with the OP's suggestion that, just because it took them until now to finish doing it, that I should be "afraid of their security practices".
    - coltonv 10y ago
      The "afraid of the security practices" was more of a joke than an actual serious jab. But I do still hold that site-wide TLS should be default by all major websites at this point in time.
- dtemp 10y ago
  Yup. Until very recently, you did most of your shopping on Amazon.com using unsecure HTTP, right up until you clicked Checkout. Only recently did they move all of the product browsing over to HTTPS.

by coltonv 10y ago

blowski 10y ago

Calling FUD on your comment. It hasn't been "standard on full sites for years", and still isn't now. Only recently with the 'HTTPS everywhere' move has the idea that public sites with no authentication should support HTTPS. And even now, that's not a universally supported opinion, because of its effect on caching. The BBC has used HTTPS on pages with forms that submit secure data, as has been the historic standard. Moving a site as massive as the BBC, which spans multiple domains and subdomains and has millions of pages is a big task. Note how you can still see news articles from the late 90s at the same URL. So, yeah, I can understand why writing a blog post about it is worthwhile.

coltonv 10y ago
Can you point out some other major sites used by the general public which have spent the last few years without site-wide SSL to back up your claim?
- blowski 10y ago
  I can do better than that - I can give you a report published by Google in March 2016 which listed lots of them. https://www.google.com/transparencyreport/https/grid/ https://www.google.com/transparencyreport/https/grid/ For example, the following are all in the world's top 100 websites and none of them support any form of HTTPS. The link includes quite a few more. * alibaba.com * ask.com * ask.fm * baidu.com * cnet.com * cnn.com * dailymail.co.uk * ebay.com * globo.com * go.com * goal.com * goo.ne.jp * imdb.com * live.com * mirror.co.uk * naver.jp * nytimes.com * onet.pl * pornhub.com * telegraph.co.uk * uol.com.br * weibo.com * wikia.com * wikihow.com * wp.pl * yahoo.co.jp * yelp.com * youporn.com
  - coltonv 10y ago
    That's scary honestly. Thanks for sharing at least.
- vtlynch 10y ago
  Washington Post. Buzzfeed. The Guardian. New York Times still dosent have HTTPs.
  - gilgongo 10y ago
    Their traffic is too high for them to afford it (and probably wouldn't outweigh the SEO uplift)
    - coltonv 10y ago
      Can I ask you why you say it would be too high for NYT to afford it, when many companies with significantly more traffic have site-wide TLS?
      - gilgongo 10y ago
        If your examples are Google or Amazon, then those have profits several orders of magnitude bigger than the likes of NYT.
    - yeukhon 10y ago
      I am actually -1 on this idea. They should be able to afford terminating SSL on the load balancer end. It doesn't change the architecture for as long as the load balancer terminates the traffic. Securing HTTPS internally is an expensive move. CPU wise has always been an argument (or more like an excuse). If your load balancer is doing computation other than forwarding requests and decryption SSL session, you should double check your architecture. If small startup will millions of views can sustain SSL traffic, why not NYT? Most their traffics are just serving static files and results are usually cached anyway. Instead, the burdens are on testing and developing the migration. For example, they'd have to inventory and edit everywhere they use http:// http:// (hardcoding the scheme in your front-end code) instead of //. Furthermore they have to support third-party ad networks deliver active scripts (like javascript) over HTTP. Having HTTP while on HTTPS will create mixed content warning and for active contents browsers will block these violations immediately, thus breaking the website. To me, the decision of not migrating to HTTPS because of infrastructure capacity is always a myth. Someone has to prove that with data.
- gilgongo 10y ago
  MailOnline. SSL would just cost too much in Akamai billing. Otherwise they'd do it straight away for the SEO uplift.
witty_username 10y ago
> It hasn't been "standard on full sites for years", and still isn't now. I'd estimate about 75% of the time I'm on an HTTPS website. > The BBC has used HTTPS on pages with forms that submit secure data, as has been the historic standard. This is insecure as the HTTP page can redirect to a malicious HTTPS page from a different domain.
- blowski 10y ago
  I agree with the need for the BBC to do this. But I disagree with the OP's suggestion that, just because it took them until now to finish doing it, that I should be "afraid of their security practices".
  - coltonv 10y ago
    The "afraid of the security practices" was more of a joke than an actual serious jab. But I do still hold that site-wide TLS should be default by all major websites at this point in time.
dtemp 10y ago
Yup. Until very recently, you did most of your shopping on Amazon.com using unsecure HTTP, right up until you clicked Checkout. Only recently did they move all of the product browsing over to HTTPS.