18 ms·
HTTPS adoption has reached the tipping point
- ploggingdev 10y agoIIRC porn sites receive significant traffic and almost all porn sites serve content over http only. The post mentions that https is faster than http and also utilizes resources better than http. Is the statement still valid when streaming video? (Please note that I visit porn sites only to check if it has https enabled or not)
- ge96 10y agohahaha
- ge96 10y ago-3! Nooo my precious points.
- Ono-Sendai 10y agoHTTPS is not faster than HTTP.
- erelde 10y agohttps://www.troyhunt.com/i-wanna-go-fast-https-massive-speed-advantage/ https://www.troyhunt.com/i-wanna-go-fast-https-massive-speed... This is by the same author, and there are critics that could be made against it. In some cases it is faster it seems.
- Ono-Sendai 10y agoHTTPS is basically HTTP, on a different port (443 instead of 80), with TLS encryption on the socket connection. TLS encryption adds overhead, it doesn't reduce it. Therefore HTTPS is slower.
- erelde 10y agotldr: HTTP/2 with TLS allows for better speeds.
- endymi0n 10y agoI think what OP was trying to convey in very few words: HTTP2 is much faster than HTTP, offsetting 50-150% (depending on what you're measuring) of the costs of encryption, as it's basically TLS only. For HTTP1, this is obviously false.
- zzzcpan 10y agoIn the context of streaming videos TLS encryption overhead is basically the only overhead that matters.
- erelde 10y agoIn fact in the dev blog of Youtube they showed it wasn't true. Can't find the post right now.
- zzzcpan 10y agoYou are incorrect, TLS overhead is too big to say something like that. Also on large requests, that you have in streaming, overhead of HTTP/1.1 protocol itself becomes negligible.
- Matthias247 10y agoAs someone who is implementing HTTP/2 I would also say that HTTP/2 has no advantage for high-bandwidth requests, e.g. video streaming. I would rather guess that even the unencrypted HTTP/2 variant might be slower than HTTP/1.1 in this scenario, since you now can't directly write into a TCP stream but have to interleave it with multiplexing info and have two flow control mechanisms working on top of each other. HTTP/2 will be mainly a large win for short requests, where it can avoid the large overhead of creating additional TCP connections and make header exchange more efficient.
- tyingq 10y agoSince http/2 is only enabled for https connections in most browsers, sometimes https is faster than http.
- erelde 10y agoI'm glad I'm not the only one it troubles that porn sites don't use https.
- segmondy 10y agoDo you pay for it? Maybe they would if people were willing to pay. https costs more resources at scale.
- angry-hacker 10y agoI know eporner.com went https long time ago and even asked opinion from users if everything is working as expected. I don't know any other porn sites that have gone https, definitely not the big ones that dominate the market such as youporn, porntube etc.
- lucideer 10y agoThis is very misleading, because it's overwhelmingly skewed toward large websites run by Google, Facebook, etc. The statistic is that 50% of page loads are HTTPS - the majority of those page loads are going to be visits to a very small subset of extremely popular (and well-resourced) sites, so this stat gives no indication that the remaining 50% is or will move to HTTPS anytime soon. The real tipping point will be 50% of unique domains visited being HTTPS. And a more interesting statistic would where that figure is now, and trend data on that. I wonder can that stat be extracted from public Mozilla data...
- curt15 10y agoIn particular, it would be interesting to see what is the adoption rate in China, whose govt makes no secret of inspecting everyone's internet traffic.
- kavok 10y agoIf you control the network infrastructure it is possible to inspect the traffic while still allowing https/SSL. https://www.a10networks.com/resources/glossary/ssl-decryption-encryption-and-inspection https://www.a10networks.com/resources/glossary/ssl-decryptio...
- pedrocr 10y agoOnly if you control the endpoints or have a compromised CA. The whole point of TLS is that you can't inspect traffic even if you own all the cables and routers between the two endpoints.
- jdiez17 10y agoHere's a question: how are captive portals going to present the login site if the user never uses HTTP? I know Android and other mobile OSs probe the network by requesting a HTTP site. On my laptop, I have to load something like `example.org` to get redirected.
- LogicX 10y agoI believe we need to work on a standard usable by those currently trying to MITM, which works with browser makers to present a nicer message to users, but maintains the privacy of their connection.
- kalleboo 10y agoThere was some discussion about that dilemma a couple weeks ago https://news.ycombinator.com/item?id=13369038 https://news.ycombinator.com/item?id=13369038 There's an RFC for a way to add this to DHCP https://tools.ietf.org/html/rfc7710 https://tools.ietf.org/html/rfc7710
- NoGravitas 10y agoThe solution is for captive portals to go away. Captive portals should absolutely not exist.
- guitarbill 10y agoiOS already prints a security warning when connecting to such networks, my hope is that Apple will simply have phones disconnect from MitM'ed networks in future, breaking captive portals but making the situation right. They only really exist where people have no other choice (e.g. hotel). They're often broken, or unusable on mobile devices with tiny UI. Captive portals are an abomination and misuse of technology, not to mention a terrible user experience. And any brand using a captive portal just diminishes my view of the brand.
- neuland 10y agoI totally agree that captive portals suck and we should name and shame anybody using them, especially ones that are poorly built. But, there has to be some reason that these exist right? To get rid of captive portals, there needs to be this functionality in the underlying protocols: - Requiring Terms of Service - Showing a special site from the service provider (like the page Starbucks takes you to after "Accept and Connect") - Selecting what kind of connection you want (like at airports and hotels where there's free and paid) - Login to some system the service provider controls (also airports and hotels w/ paid plans) - ... and, potentially other things I haven't seen Edit: Somewhere else in this thread, kelleboo mentioned this [0] [0] https://tools.ietf.org/html/rfc7710 https://tools.ietf.org/html/rfc7710
- exodust 10y agoIf my little web page containing a few photos of flowers is never moved to HTTPS, is that bad in any practical sense at all? Is there any plausible scenario whereby visiting such a basic site without any forms or data collection over HTTP is in some way a disadvantage to HTTPS?
- nerdponx 10y agoAs far as I understand, it leaves your user is vulnerable to man in the middle attacks, injecting malicious code and so on.
- TheCycoONE 10y agoSure - your site is vulnerable to a MitM attack where the attacker abuses the trust your visitors have in your flower site to exploit whatever the latest browser vulnerability of the week is and compromise their computers.
- caf 10y agoSure. A MITM can inject javascript into the HTML the user receives from your site (just like the Comcast bandwidth cap example in the article) that causes the browser to open phishing or browser exploit pages.
- exodust 10y agoOk, fair enough. MITM attacks seems to be the consensus and good enough reason to move the flower page over to HTTPS.
- fiatjaf 10y agoThe disadvantage is only that Google will punish your site in its searches.
- exodust 10y agoThat was kind of what I was thinking, but several replies above mention MITM attacks, which I thought were extremely rare and non-trivial to execute, but I don't read up on that stuff much.
- cyberferret 10y agoI just upgraded our blog site this week to a new Digital Ocean Ubuntu instance, and used LetsEncrypt to install an SSL certificate on it. I couldn't believe just how easy and QUICK it was! Certainly a far cry from 15 years ago when I used to go through the Spanish Inquisition to get an SSL certificate, not to mention the cost. LetsEncrypt has been a game changer. So too has AWS, with their Certificate Manager. I've been rolling out their own issued SSL certs to our various Elastic Beanstalk instances as they come up for renewal. Saving a pile of money, but more importantly, TIME, doing this. For me personally, that is the tipping point - making SSL installs on server a couple of mouse click and less than a minute. Not surprised that it is becoming increasingly popular given this.
- arbuge 10y agoFor us this came with cPanel started including it by default. All you needed to do was a few lines in your .htaccess to forward all http requests to their equivalent https ones. Almost all our sites except for a few edge cases are switched over now.
- sp332 10y agoIt's definitely hit a tipping point for me. I installed HTTP Nowhere a couple of weeks ago and hardly ever run into a site I can't at least load up in the Internet Archive!
- mzzter 10y agoServices like cloudflare make it dead-easy to set up https. The more one-click https setups there are the faster we'll vault right over the tipping point.
- _pdp_ 10y agoSorry but I disagree. Please install PanicMode browser extension for Chrome (https://chrome.google.com/webstore/detail/panic-mode/lamdafciglhnjofdfejeepoemldmblkb https://chrome.google.com/webstore/detail/panic-mode/lamdafc...) and try to surf the web for a day. You will know what I mean as soon as you go through this experiment. Disclaimer: I am the author of this extension. I wrote the extension for personal reasons and it is very simplistic in nature. If you turn PanicMode on it will replace every outgoing http:// http:// url with https:// https://. It does nothing else besides that and unlike HTTPS Everywhere it has no exceptions list or special handling of the top 100 sites, etc. The site you are visiting should either support https:// https:// or it will blow up in your face, which is exactly what happens 90% of the time. Edit: Besides just because Firefox is seeing more HTTPS traffic means nothing if all the traffic comes from Facebook, Google, YouTube and a few others. Yes, there is more traffic and yes it is encrypted but does it really say anything about the state of the web? Someone needs to put this data out to make it clear.
- cpeterso 10y ago"HTTP Nowhere" is a Firefox extension that blocks all non-HTTPS requests. It doesn't try to rewrite HTTP requests to HTTPS, though. https://addons.mozilla.org/en-US/firefox/addon/http-nowhere/ https://addons.mozilla.org/en-US/firefox/addon/http-nowhere/
- Teapot 10y agoI can easily configure NoScript to only use HTTPS on, say, ¤.cn . Sites that downgrade-redirects to http:// http:// gets stuck in a loop. Annoying for everyone, so it raises awareness. The prefs.js syntax is, noscript.httpsForced "¤.cn\n¤.ru\n*.uk" Edits: ¤ characters are asterisks.
- tobltobs 10y agoWhat is the situation with available Adsense ads? Do I still have to except lower inventories of HTTPS enabled ads and thereby less income if I switch to HTTPS? I understand that this depends on the target audience. Did anybody experienced a drop at the beginning and later recovering?
- Mindless2112 10y agoI'll believe we've hit the tipping point when I type "example.com" into the browser address bar and it takes me to https://example.com https://example.com rather than http://example.com http://example.com.