3 ms·

I realize this site is referring to password storage but it is itself a plaintext offender in that it doesn't support https.

semperdark 9y ago
All of the areas where you can actually submit data or login (comments, submit a site) are in https iframes. I'd agree that there are benefits for read-only sites using https, but it's not quite as serious.
- lunixbochs 9y ago
  it's mostly pointless to have an https iframe on an http site, as you won't know if the page is intercepted and the iframe is replaced
  - semperdark 9y ago
    That's a good point. I only really deal with https-enabled sites any more - hadn't even thought of that.
drkstr 9y ago
Why does everything need to be https? Are you worried someone might find out what kinda lols your into?
- gboudrias 9y ago
  https://https.cio.gov/everything/ https://https.cio.gov/everything/ Privacy is beneficial in itself, but also: > protecting less sensitive sites strengthens the protections of more sensitive sites Any site that can be MITMed is a site that can be used to gather personal information and escalate from there. Especially seeing as most people reuse passwords like crazy.
- RossM 9y ago
  Yes, everything does need to be HTTPS. If not for user privacy then for response integrity - to be sure the response hasn't been MITMed. You might think most sites are innocuous, but it depends on where you live. I could see this site getting classified as "hacking/encryption-related" by something like sonicwall's firewall (HN too). What if your government tasks your ISP to round up all those trying to bypass state firewalls? Heck I live in a western country where our government is misguidedly angling to ban encryption. For the minimal effort involved, I believe all sites should be https.
- taneq 9y ago
  The same reason the pharmacy puts your order into a brown paper bag even though you only bought some cough drops: That it provides cover for the next customer, who's buying hemorrhoid cream or whatever. If you only encrypt the sensitive stuff then encryption flags your stuff as sensitive.

semperdark 9y ago

All of the areas where you can actually submit data or login (comments, submit a site) are in https iframes. I'd agree that there are benefits for read-only sites using https, but it's not quite as serious.

lunixbochs 9y ago
it's mostly pointless to have an https iframe on an http site, as you won't know if the page is intercepted and the iframe is replaced
- semperdark 9y ago
  That's a good point. I only really deal with https-enabled sites any more - hadn't even thought of that.

drkstr 9y ago

Why does everything need to be https? Are you worried someone might find out what kinda lols your into?

gboudrias 9y ago
https://https.cio.gov/everything/ https://https.cio.gov/everything/ Privacy is beneficial in itself, but also: > protecting less sensitive sites strengthens the protections of more sensitive sites Any site that can be MITMed is a site that can be used to gather personal information and escalate from there. Especially seeing as most people reuse passwords like crazy.
RossM 9y ago
Yes, everything does need to be HTTPS. If not for user privacy then for response integrity - to be sure the response hasn't been MITMed. You might think most sites are innocuous, but it depends on where you live. I could see this site getting classified as "hacking/encryption-related" by something like sonicwall's firewall (HN too). What if your government tasks your ISP to round up all those trying to bypass state firewalls? Heck I live in a western country where our government is misguidedly angling to ban encryption. For the minimal effort involved, I believe all sites should be https.
taneq 9y ago
The same reason the pharmacy puts your order into a brown paper bag even though you only bought some cough drops: That it provides cover for the next customer, who's buying hemorrhoid cream or whatever. If you only encrypt the sensitive stuff then encryption flags your stuff as sensitive.