6 ms·

Surely it would be easier to just get a cert. What's preventing these types from doing so?

gruez 9y ago
What's easier for a dev: inserting a few lines of code, or getting access to the production server, setting up letsencrypt (or getting a budget approval for the $10/year certificate)?
- robteix 9y ago
  Code is rarely the same as "inserting a few lines of code" though. They presumably had to think about how to work around the problem, look for an appropriate font, etc. All for the purpose of hiding a symptom of an underlying problem.
  - kgbme 9y ago
    Yes, exactly - there's a framework in place, which allows for the bullchit. :/
robteix 9y ago
I believe it's either (a) a lack of understanding of _why_ one should use SSL or (b) a mistaken sense of principle of standing up to the perceived bulliness of Google, which, come to think of it, it's basically an application of (a)
- josteink 9y ago
  > (b) a mistaken sense of principle of standing up to the perceived bulliness of Google, which, come to think of it, it's basically an application of (a) But Google has been bullying around with their behaviour. I don't think that's even debatable.
  - prophesi 9y ago
    They have been bullying around, but their enforcement of HTTPS for forms with password inputs shouldn't count as one of their instances of bullying. It's something browser vendors should have implemented long ago, even before LetsEncrypt came along, because it is highly insecure and users should know about it.
    - throwaway6845 9y ago
      Fortunately Google is consistent about enforcing encryption anywhere where passwords could be intercepted. Oh, wait. http://blog.elliottkember.com/chromes-insane-password-security-strategy http://blog.elliottkember.com/chromes-insane-password-securi... And if you disagree with them, you're "a novice". https://news.ycombinator.com/item?id=6166886 https://news.ycombinator.com/item?id=6166886
      - prophesi 9y ago
        That article is from 2013. You can set a master password on Chrome now. It then requests that password whenever you wish to view a password in the manager. If you don't set a master password, then your passwords are (presumably) encrypted with your google account. So anyone using Chrome that's logged into your google account will be able to view the passwords via settings. So just don't let malicious users use your Chrome? Edit: And there's also a guest mode for Chrome, but they can just exit out of the window and run a regular instance of Chrome to use it under your profile.
    - aaronmdjones 9y ago
      > It's something browser vendors should have implemented long ago Netscape Navigator did this (almost) 20 years ago. EDIT: Link. http://www.kentlaw.edu/faculty/rwarner/classes/legalaspects/digital_signatures/VeriSign%20OnSite%20for%20Secure%20Server%20IDs_files/fig2.gif http://www.kentlaw.edu/faculty/rwarner/classes/legalaspects/...
Freak_NL 9y ago
These kind of websites rely on having a huge number of domains (for branding purposes) all doing roughly the same thing. In this case basically 'Shop*.ca'. Of course HTTPS can be automated and facilitated with LetsEncrypt, but it would require switching a working system from one way of doing things to another. It's an investment they are not willing to make, because their customers (shops willing to pay for an extended listing on those websites) are shopkeepers, not tech-savvy users asking for improved security.

What's easier for a dev: inserting a few lines of code, or getting access to the production server, setting up letsencrypt (or getting a budget approval for the $10/year certificate)?

robteix 9y ago
Code is rarely the same as "inserting a few lines of code" though. They presumably had to think about how to work around the problem, look for an appropriate font, etc. All for the purpose of hiding a symptom of an underlying problem.
- kgbme 9y ago
  Yes, exactly - there's a framework in place, which allows for the bullchit. :/

robteix 9y ago

I believe it's either (a) a lack of understanding of _why_ one should use SSL or (b) a mistaken sense of principle of standing up to the perceived bulliness of Google, which, come to think of it, it's basically an application of (a)

josteink 9y ago
> (b) a mistaken sense of principle of standing up to the perceived bulliness of Google, which, come to think of it, it's basically an application of (a) But Google has been bullying around with their behaviour. I don't think that's even debatable.
- prophesi 9y ago
  They have been bullying around, but their enforcement of HTTPS for forms with password inputs shouldn't count as one of their instances of bullying. It's something browser vendors should have implemented long ago, even before LetsEncrypt came along, because it is highly insecure and users should know about it.
  - throwaway6845 9y ago
    Fortunately Google is consistent about enforcing encryption anywhere where passwords could be intercepted. Oh, wait. http://blog.elliottkember.com/chromes-insane-password-security-strategy http://blog.elliottkember.com/chromes-insane-password-securi... And if you disagree with them, you're "a novice". https://news.ycombinator.com/item?id=6166886 https://news.ycombinator.com/item?id=6166886
    - prophesi 9y ago
      That article is from 2013. You can set a master password on Chrome now. It then requests that password whenever you wish to view a password in the manager. If you don't set a master password, then your passwords are (presumably) encrypted with your google account. So anyone using Chrome that's logged into your google account will be able to view the passwords via settings. So just don't let malicious users use your Chrome? Edit: And there's also a guest mode for Chrome, but they can just exit out of the window and run a regular instance of Chrome to use it under your profile.
  - aaronmdjones 9y ago
    > It's something browser vendors should have implemented long ago Netscape Navigator did this (almost) 20 years ago. EDIT: Link. http://www.kentlaw.edu/faculty/rwarner/classes/legalaspects/digital_signatures/VeriSign%20OnSite%20for%20Secure%20Server%20IDs_files/fig2.gif http://www.kentlaw.edu/faculty/rwarner/classes/legalaspects/...

Freak_NL 9y ago

These kind of websites rely on having a huge number of domains (for branding purposes) all doing roughly the same thing. In this case basically 'Shop*.ca'. Of course HTTPS can be automated and facilitated with LetsEncrypt, but it would require switching a working system from one way of doing things to another. It's an investment they are not willing to make, because their customers (shops willing to pay for an extended listing on those websites) are shopkeepers, not tech-savvy users asking for improved security.