4 ms·

HTTP is fine for most websites. HTTPS makes sense for certain parts of websites like e-commerce. Even Amazon website (beside .com) is HTTP with only the login p

by frik 10y ago

HTTP is fine for most websites. HTTPS makes sense for certain parts of websites like e-commerce. Even Amazon website (beside .com) is HTTP with only the login page and checkout page on a HTTPS sub-domain. It's fine since 1995, and no one complains or has problems with that. Labeling HTTP as insecure is just plain wrong. I would beg to differ, sometimes HTPS is more insecure than HTTP: think of Hearthbleed bug that made servers with HTTPS vulnerable or certs that shouldn't be trusted, or the day when all LetsCrypt users were vulnerable, etc. Also you will loose a lot of ad-money. Of course Google with their search monopoly wants HTTPS because they profit from it. It's sad that Mozilla is influenced by some lobbyist. Well hopefully the popular forks on Linux distros remove that stupid warning label.

imajes 10y ago
Why are you going to lose Advertiser money? That's bogus. Why does Google profit from HTTPS over HTTP? Amazon.com (HTTP) redirects to (HTTPS), via a 301 - that's Permanent Redirection. This also isn't Mozilla, but Chrome. And honestly i don't even know where to begin, but you should look into HSTS, and the vulnerabilities that exist transitioning between the two modes[1], as well as looking at the issues (data bleed, etc) that happen with a http+https web and mixed content. Finally the bigger issue to ad rev is likely to be cross origin content rather than https. and, er, semantically there's a gulf of difference between "Not Secure" and "Insecure". Also, arguably, the shift to a https first web is what's helping us shine light into bad CAs and deeper audits that are finding the esoteric bugs -- so it's only a good thing, in the long term. [1]: http://michael-coates.blogspot.com/2009/02/compromising-http-to-https-redirects.html http://michael-coates.blogspot.com/2009/02/compromising-http...
- throwaway6845 10y ago
  > Why does Google profit from HTTPS over HTTP? Because it removes the ability for ISPs to act as a competitor to Google by injecting ads and profiling customer browsing. You may not like that ISPs have done that (I don't) but it's competition for Google, and removing it is therefore good for Google's profits.
guessmyname 10y ago
> Even Amazon [...] is HTTP with only the login page and checkout page on a HTTPS That is the idea of the "insecure" text, they will display it when the browser detects a form with a password field, a form requesting credit card information, and stuff like that. I am not completely sure, but I believe they will continue showing the information icon only for the rest of the pages if the site is not on HTTPS.
- frik 10y ago
  It's the typical salami tactic. And I am not falling for that. You know it's how Facebook changed their privacy settings all the time (at least in 2009-2012 timeframe). Or how Microsoft is changing the UI and user privacy Windows 8/10 and Office 365/2016. 1) Two steps forward (ignoring all user feedback, focused on internal aganda) 2) Public outcry, pending backslash 3) One step back (PR announcement like "we care..., we want the best for the user...), repeat with step 1 Everyone who knows about how it works, will hate that tactics. Sadly, many with less insight fall for such evil tactics.
rocky1138 10y ago
Every time this comes up someone writes a comment like yours. It's good that we have these discussions. A major problem in North America is one of ISPs and Hotels injecting ads into HTTP requests.
- frik 10y ago
  Good that you mentioned that. I already though, wow, so many dumb users here (the other replies) on HN. Well, it seems some have a bad luck with their ISP that do some shaddy ad-injecting. But why not use another ISP or VPN? I would say most internet users still have a neutral ISP if you look at it at grander world wide view. And as long as HTTP works so fine for all Amazon e-commerce websites "beside their US centric Amazin.com" (as I wrote, but some didn't get), I am the opinion that HTTP is a viable option and shouldn't be treated as legacy by Google at all. The whole HTTP/2 movement seems fishy to me, if you know how it works and who benefits the most, then you know also why they lobby for it.but as they now try to deprecate HTTP/1 that a very evil move, and everyone who supports that because he gets paid for lobbying should be very ashamed (and sure some users are still ill informed and go with the masses, nothing new, but they were previously not part of the HN community, but on other sites like Reddit or whatever).
  - pfg 10y ago
    > And as long as HTTP works so fine for all Amazon e-commerce websites "beside their US centric Amazin.com" (as I wrote, but some didn't get) I've checked amazon.de, amazon.co.uk, amazon.fr, amazon.ca and amazon.de, and they're all served via HTTPS (including a HTTP->HTTPS redirect).
cJ0th 10y ago
I am no expert on this topic but I think HTTPS prevents ISPs from seeing the complete URL you've entered. For instance, if Wikipedia were http only your ISP would see that you visited http://en.wikipedia.com/really-bad-disease http://en.wikipedia.com/really-bad-disease whereas a https url would only reveal that you visited Wikipedia.
echeese 10y ago
Amazon.com has HSTS, you can't access it from HTTP. If your website uses sessions at all, you need to use HTTPS just to protect from session hijacking. On every page. Better yet, mark that cookie as secure-only.
- rocky1138 10y ago
  Hi Ryan. I'm fairly confident that amazon.com is in the preload list in Chrome and Firefox, but if a given domain isn't, then the very first request from a browser may be to http which then includes the HSTS header and _then_ any subsequent request can only be over HTTPS.
AgentME 10y ago
>sometimes HTPS is more insecure than HTTP: think of Hearthbleed bug that made servers with HTTPS vulnerable or certs that shouldn't be trusted HTTP connections are vulnerable to MITM attacks 100% of the time. HTTPS-related vulnerabilities are rare and have rarely been worse than degrading the connection to HTTP security. Why would Google uniquely profit from HTTPS?

by frik 10y ago

imajes 10y ago

Why are you going to lose Advertiser money? That's bogus. Why does Google profit from HTTPS over HTTP? Amazon.com (HTTP) redirects to (HTTPS), via a 301 - that's Permanent Redirection. This also isn't Mozilla, but Chrome. And honestly i don't even know where to begin, but you should look into HSTS, and the vulnerabilities that exist transitioning between the two modes[1], as well as looking at the issues (data bleed, etc) that happen with a http+https web and mixed content. Finally the bigger issue to ad rev is likely to be cross origin content rather than https. and, er, semantically there's a gulf of difference between "Not Secure" and "Insecure". Also, arguably, the shift to a https first web is what's helping us shine light into bad CAs and deeper audits that are finding the esoteric bugs -- so it's only a good thing, in the long term. [1]: http://michael-coates.blogspot.com/2009/02/compromising-http-to-https-redirects.html http://michael-coates.blogspot.com/2009/02/compromising-http...

throwaway6845 10y ago
> Why does Google profit from HTTPS over HTTP? Because it removes the ability for ISPs to act as a competitor to Google by injecting ads and profiling customer browsing. You may not like that ISPs have done that (I don't) but it's competition for Google, and removing it is therefore good for Google's profits.

guessmyname 10y ago

> Even Amazon [...] is HTTP with only the login page and checkout page on a HTTPS That is the idea of the "insecure" text, they will display it when the browser detects a form with a password field, a form requesting credit card information, and stuff like that. I am not completely sure, but I believe they will continue showing the information icon only for the rest of the pages if the site is not on HTTPS.

frik 10y ago
It's the typical salami tactic. And I am not falling for that. You know it's how Facebook changed their privacy settings all the time (at least in 2009-2012 timeframe). Or how Microsoft is changing the UI and user privacy Windows 8/10 and Office 365/2016. 1) Two steps forward (ignoring all user feedback, focused on internal aganda) 2) Public outcry, pending backslash 3) One step back (PR announcement like "we care..., we want the best for the user...), repeat with step 1 Everyone who knows about how it works, will hate that tactics. Sadly, many with less insight fall for such evil tactics.

rocky1138 10y ago

Every time this comes up someone writes a comment like yours. It's good that we have these discussions. A major problem in North America is one of ISPs and Hotels injecting ads into HTTP requests.

frik 10y ago
Good that you mentioned that. I already though, wow, so many dumb users here (the other replies) on HN. Well, it seems some have a bad luck with their ISP that do some shaddy ad-injecting. But why not use another ISP or VPN? I would say most internet users still have a neutral ISP if you look at it at grander world wide view. And as long as HTTP works so fine for all Amazon e-commerce websites "beside their US centric Amazin.com" (as I wrote, but some didn't get), I am the opinion that HTTP is a viable option and shouldn't be treated as legacy by Google at all. The whole HTTP/2 movement seems fishy to me, if you know how it works and who benefits the most, then you know also why they lobby for it.but as they now try to deprecate HTTP/1 that a very evil move, and everyone who supports that because he gets paid for lobbying should be very ashamed (and sure some users are still ill informed and go with the masses, nothing new, but they were previously not part of the HN community, but on other sites like Reddit or whatever).
- pfg 10y ago
  > And as long as HTTP works so fine for all Amazon e-commerce websites "beside their US centric Amazin.com" (as I wrote, but some didn't get) I've checked amazon.de, amazon.co.uk, amazon.fr, amazon.ca and amazon.de, and they're all served via HTTPS (including a HTTP->HTTPS redirect).

cJ0th 10y ago

I am no expert on this topic but I think HTTPS prevents ISPs from seeing the complete URL you've entered. For instance, if Wikipedia were http only your ISP would see that you visited http://en.wikipedia.com/really-bad-disease http://en.wikipedia.com/really-bad-disease whereas a https url would only reveal that you visited Wikipedia.

echeese 10y ago

Amazon.com has HSTS, you can't access it from HTTP. If your website uses sessions at all, you need to use HTTPS just to protect from session hijacking. On every page. Better yet, mark that cookie as secure-only.

rocky1138 10y ago
Hi Ryan. I'm fairly confident that amazon.com is in the preload list in Chrome and Firefox, but if a given domain isn't, then the very first request from a browser may be to http which then includes the HSTS header and _then_ any subsequent request can only be over HTTPS.

AgentME 10y ago

>sometimes HTPS is more insecure than HTTP: think of Hearthbleed bug that made servers with HTTPS vulnerable or certs that shouldn't be trusted HTTP connections are vulnerable to MITM attacks 100% of the time. HTTPS-related vulnerabilities are rare and have rarely been worse than degrading the connection to HTTP security. Why would Google uniquely profit from HTTPS?