5 ms·

I totally agree with this. Sites that do financial transactions, or require user logons or user submissions (forums, comments etc.) need to be SSL, most others

by Jaruzel 10y ago

I totally agree with this. Sites that do financial transactions, or require user logons or user submissions (forums, comments etc.) need to be SSL, most others don't need to be secure at all. If I am reading a random blog by Joe, and he doesn't have a comments section, why does the site need to be in HTTPS? Scaling that up - if I'm not logged into Wikipedia, and simply searching and reading articles, why does that need to be served under HTTPS either? By forcing every site to go HTTPS not only increases the cost of ownership (in time, and optionally, cost) but also adds complexity for small site owners, and completely goes against the open web ideal. It should be down to the owner of the site if they want to add SSL, those that don't and fulfil the criteria I've outlined, should not be penalised for it. There's hardly any overhead involved if you add to the browsers page parsing routines a function to identify input fields, and mark a warning on the address bar accordingly if the site is not secure. Blanket warning on all non-HTTP sites is just lazy.

asherkin 10y ago
> Scaling that up - if I'm not logged into Wikipedia, and simply searching and reading articles, why does that need to be served under HTTPS either? Because a malicious MITM could modify the content you are reading (and thus affect your perception of a subject). A bit of misinformation here and there can go a long way.
- tdkl 10y ago
  Targeting Wikipedia is different then personal static blog of John Doe. Wikipedia has resources for this, John doesn't - hence threatening the open web.
RegW 10y ago
Conversely sites such as Carphone Warehouse who buy a certificate, would get advertised by Chrome to the uninitiated as "Secure". Despite woeful backend security: http://www.bbc.co.uk/news/uk-33835185 http://www.bbc.co.uk/news/uk-33835185.
- regecks 10y ago
  That's not even the worst of it. Websites that use reverse proxies such as Cloudflare to give them the HTTPS for the first leg (visitor->Cloudflare) give no indication that the second leg (Cloudflare->origin) may be totally in the clear. The UX is going to be tricky to get right.
Klathmon 10y ago
> if I'm not logged into Wikipedia, and simply searching and reading articles, why does that need to be served under HTTPS either? Because we have already seen tampering that could really cause some issues. Injecting ads, snooping on search info to target advertising, things like censoring specific articles or specific topics. Because of how global the internet is, regulation can't really solve many of it's issues (unless literally everyone can agree on the rules), so we need to solve them technically. Securing you to the server makes all of those things much more difficult. >By forcing every site to go HTTPS not only increases the cost of ownership (in time, and optionally, cost) but also adds complexity for small site owners, and completely goes against the open web ideal. Then let's solve those issues. Added complexity is not a reason to abandon TLS for most sites, it should be a goal to not only get TLS, but to make the process easier for the average joe to setup and run. By starting to push in the direction of "TLS everywhere" we are encouraging more automatic and easy ways of maintaining this stuff (just look at how far let's encrypt has come in such a short time! How long until it's a GUI program that even my grandfather can use?).
pdkl95 10y ago
> simply searching and reading articles Encryption protects against an eavesdropper logging what you read. > It should be down to the owner of the site if they want to add SSL The owner of the site shouldn't also be able to force others to drop their protections against eavesdropping. There are two parties to each conversation. > There's hardly any overhead involved if you add to the browsers page parsing routines That only covers a small subset of threat models. Passwords and other credentials are not the only data that needs protection. Thanks to Lets Encrypt, enabling encryption has hardly any overhead. Most of the problems are outdated software and hosting services. Encryption is important not only for personal safety, it's also needed to protect against threats like China's Great Cannon[1]. Choosing to say with plaintext is socially irresponsible because the decision about using encryption is also about providing ammunition for the Great Cannon. [1] https://citizenlab.org/2015/04/chinas-great-cannon/ https://citizenlab.org/2015/04/chinas-great-cannon/

by Jaruzel 10y ago

asherkin 10y ago

> Scaling that up - if I'm not logged into Wikipedia, and simply searching and reading articles, why does that need to be served under HTTPS either? Because a malicious MITM could modify the content you are reading (and thus affect your perception of a subject). A bit of misinformation here and there can go a long way.

tdkl 10y ago
Targeting Wikipedia is different then personal static blog of John Doe. Wikipedia has resources for this, John doesn't - hence threatening the open web.

RegW 10y ago

Conversely sites such as Carphone Warehouse who buy a certificate, would get advertised by Chrome to the uninitiated as "Secure". Despite woeful backend security: http://www.bbc.co.uk/news/uk-33835185 http://www.bbc.co.uk/news/uk-33835185.

regecks 10y ago
That's not even the worst of it. Websites that use reverse proxies such as Cloudflare to give them the HTTPS for the first leg (visitor->Cloudflare) give no indication that the second leg (Cloudflare->origin) may be totally in the clear. The UX is going to be tricky to get right.

Klathmon 10y ago

> if I'm not logged into Wikipedia, and simply searching and reading articles, why does that need to be served under HTTPS either? Because we have already seen tampering that could really cause some issues. Injecting ads, snooping on search info to target advertising, things like censoring specific articles or specific topics. Because of how global the internet is, regulation can't really solve many of it's issues (unless literally everyone can agree on the rules), so we need to solve them technically. Securing you to the server makes all of those things much more difficult. >By forcing every site to go HTTPS not only increases the cost of ownership (in time, and optionally, cost) but also adds complexity for small site owners, and completely goes against the open web ideal. Then let's solve those issues. Added complexity is not a reason to abandon TLS for most sites, it should be a goal to not only get TLS, but to make the process easier for the average joe to setup and run. By starting to push in the direction of "TLS everywhere" we are encouraging more automatic and easy ways of maintaining this stuff (just look at how far let's encrypt has come in such a short time! How long until it's a GUI program that even my grandfather can use?).

pdkl95 10y ago

> simply searching and reading articles Encryption protects against an eavesdropper logging what you read. > It should be down to the owner of the site if they want to add SSL The owner of the site shouldn't also be able to force others to drop their protections against eavesdropping. There are two parties to each conversation. > There's hardly any overhead involved if you add to the browsers page parsing routines That only covers a small subset of threat models. Passwords and other credentials are not the only data that needs protection. Thanks to Lets Encrypt, enabling encryption has hardly any overhead. Most of the problems are outdated software and hosting services. Encryption is important not only for personal safety, it's also needed to protect against threats like China's Great Cannon[1]. Choosing to say with plaintext is socially irresponsible because the decision about using encryption is also about providing ammunition for the Great Cannon. [1] https://citizenlab.org/2015/04/chinas-great-cannon/ https://citizenlab.org/2015/04/chinas-great-cannon/