5 ms·

Why do you need to encrypt your connection to that site? No sensitive info sent.

ash 9y ago
Just a few reasons: * To overcome government censorship and surveillance. * To stop internet providers from injecting ads and tracking scripts.
- MikkoFinell 9y ago
  >To overcome government censorship and surveillance. But the site isn't being censored? Also https won't stop the government from knowing that you connected to those servers. I agree that we want to avoid censorship and surveillance in general, but it really doesn't seem relevant here. >To stop internet providers from injecting ads and tracking scripts. Is your ISP actually doing that to you right now? Or is that just hypothetical?
  - hobofan 9y ago
    > But the site isn't being censored? How do you know? Without https, a MITM-attack might already be in place, and you wouldn't even notice.
    - MikkoFinell 9y ago
      I guess that's a fair point.
  - artpar 9y ago
    > Is your ISP actually doing that to you right now? Or is that just hypothetical? Yes there are multiple instances where my isp was injecting stuff. More frequently at public wifi spots.
  - eadmund 9y ago
    > Is your ISP actually doing that to you right now? Or is that just hypothetical? I was on a Southwest flight earlier this week which did exactly this, using HTTP injection to display an overlay on every HTTP page. It's certainly useful to provide flight information (or Amber alerts, weather information, billing alerts), but it's Just Wrong™ to violate the integrity of a communication to do so. Perhaps there should be some standard protocol for ISPs to send messages to clients, permitting the connected OS to determine how to display them?
  - djsumdog 9y ago
    I can't remember which country it was, but it was either a Vodaphone or O2 sim which would inject their little banner at the top of websites that weren't HTTPS. It was super annoying, especially seeing it on my own site!
  - mbrock 9y ago
    A café I go to sometimes for coffee injects ads to non-HTTPS websites. Full screen ads with a timer. It's a good reminder that HTTP sites can be and are being arbitrarily manipulated and surveilled by WiFi operators.
  - hackmiester 9y ago
    My ISP, WideOpenWest, uses HTTP injection as their primary method for notifying customers of maintenance, etc.
- mrob 9y ago
  It wouldn't stop surveillance, because there are only a limited number of pages it can serve. It's possible for an attacker to download all of them and figure out what you're reading by traffic analysis.
  - creatonez 9y ago
    A monumentally more difficult task than intercepting an unencrypted connection.
hobofan 9y ago
Which politically charged articles you read can very much be sensitive information. When in question, all information is sensitive.
rollcat 9y ago
All information is sensitive. Encrypt everything.
amptorn 9y ago
It's nobody's business what stories I read.
aendruk 9y ago
There's a whole website by the Freedom of the Press Foundation that addresses that question: https://securethe.news https://securethe.news

ash 9y ago

Just a few reasons: * To overcome government censorship and surveillance. * To stop internet providers from injecting ads and tracking scripts.

MikkoFinell 9y ago
>To overcome government censorship and surveillance. But the site isn't being censored? Also https won't stop the government from knowing that you connected to those servers. I agree that we want to avoid censorship and surveillance in general, but it really doesn't seem relevant here. >To stop internet providers from injecting ads and tracking scripts. Is your ISP actually doing that to you right now? Or is that just hypothetical?
- hobofan 9y ago
  > But the site isn't being censored? How do you know? Without https, a MITM-attack might already be in place, and you wouldn't even notice.
  - MikkoFinell 9y ago
    I guess that's a fair point.
- artpar 9y ago
  > Is your ISP actually doing that to you right now? Or is that just hypothetical? Yes there are multiple instances where my isp was injecting stuff. More frequently at public wifi spots.
- eadmund 9y ago
  > Is your ISP actually doing that to you right now? Or is that just hypothetical? I was on a Southwest flight earlier this week which did exactly this, using HTTP injection to display an overlay on every HTTP page. It's certainly useful to provide flight information (or Amber alerts, weather information, billing alerts), but it's Just Wrong™ to violate the integrity of a communication to do so. Perhaps there should be some standard protocol for ISPs to send messages to clients, permitting the connected OS to determine how to display them?
- djsumdog 9y ago
  I can't remember which country it was, but it was either a Vodaphone or O2 sim which would inject their little banner at the top of websites that weren't HTTPS. It was super annoying, especially seeing it on my own site!
- mbrock 9y ago
  A café I go to sometimes for coffee injects ads to non-HTTPS websites. Full screen ads with a timer. It's a good reminder that HTTP sites can be and are being arbitrarily manipulated and surveilled by WiFi operators.
- hackmiester 9y ago
  My ISP, WideOpenWest, uses HTTP injection as their primary method for notifying customers of maintenance, etc.
mrob 9y ago
It wouldn't stop surveillance, because there are only a limited number of pages it can serve. It's possible for an attacker to download all of them and figure out what you're reading by traffic analysis.
- creatonez 9y ago
  A monumentally more difficult task than intercepting an unencrypted connection.

hobofan 9y ago

Which politically charged articles you read can very much be sensitive information. When in question, all information is sensitive.

rollcat 9y ago

All information is sensitive. Encrypt everything.

amptorn 9y ago

It's nobody's business what stories I read.

aendruk 9y ago

There's a whole website by the Freedom of the Press Foundation that addresses that question: https://securethe.news https://securethe.news