4 ms·

I get that HTTPS is good for anything that's got sensitive data, but what really is the point of enabling it if you've got a static, old-school informational pa

I get that HTTPS is good for anything that's got sensitive data, but what really is the point of enabling it if you've got a static, old-school informational page? Aside from avoiding getting dinged by search engines?

pluma 9y ago
Herd immunity. If only sensitive data uses HTTPS, all HTTPS use is suspicious. If everything is HTTPS, the fact something uses HTTPS no longer makes it suspicious/interesting. It also makes policies banning access to HTTPS websites (i.e. clumsy traffic control) unfeasible.
lima 9y ago
ISPs are known to profile their customers by looking at unencrypted traffic or even inject ads. Delivering browser exploits by injecting into unencrypted traffic is common practice.
C4K3 9y ago
Authenticity. To prevent somebody from modifying the page against your will, e.g. ISPs/Wifi hotspots inserting ads into all http pages. Example (out of many): https://www.techdirt.com/articles/20140908/07191228453/comcast-using-packet-injection-to-push-its-own-ads-via-wifi-apparently-oblivious-to-security-concerns.shtml https://www.techdirt.com/articles/20140908/07191228453/comca...
Matt3o12_ 9y ago
There are a couple of reason. Encryption also preserves the data integrity. That means your ISP cannot inject ads or tracking scripts. I’ve heard that this is already quite common in some countries (including mobile services in the US). This also means that nobody who sits between the server and your internet connection can inject falsified information into that static page. You also have more privacy. An attack can see that you are accessing Hacker News but not necessary what comment section you are on (though it can sometimes be inferred by the page size). You might not care about that about your oldschool static side but someone who lives in suppressive countries might because it might make a big difference if they only access Hacker News for the latest and trendiest node framework or if you actively research the comments about articles how your country does something bad.
marcosdumay 9y ago
Have you seen those Intel-ME vulnerabilities that were on the front page yesterday and people kept saying they were not as bad as they look, because an attack would need to come from your LAN? Injecting some Javascript into your static, non-sensitive pages is a great way to start an attack from inside your LAN.

pluma 9y ago

Herd immunity. If only sensitive data uses HTTPS, all HTTPS use is suspicious. If everything is HTTPS, the fact something uses HTTPS no longer makes it suspicious/interesting. It also makes policies banning access to HTTPS websites (i.e. clumsy traffic control) unfeasible.

lima 9y ago

ISPs are known to profile their customers by looking at unencrypted traffic or even inject ads. Delivering browser exploits by injecting into unencrypted traffic is common practice.

C4K3 9y ago

Authenticity. To prevent somebody from modifying the page against your will, e.g. ISPs/Wifi hotspots inserting ads into all http pages. Example (out of many): https://www.techdirt.com/articles/20140908/07191228453/comcast-using-packet-injection-to-push-its-own-ads-via-wifi-apparently-oblivious-to-security-concerns.shtml https://www.techdirt.com/articles/20140908/07191228453/comca...

Matt3o12_ 9y ago

There are a couple of reason. Encryption also preserves the data integrity. That means your ISP cannot inject ads or tracking scripts. I’ve heard that this is already quite common in some countries (including mobile services in the US). This also means that nobody who sits between the server and your internet connection can inject falsified information into that static page. You also have more privacy. An attack can see that you are accessing Hacker News but not necessary what comment section you are on (though it can sometimes be inferred by the page size). You might not care about that about your oldschool static side but someone who lives in suppressive countries might because it might make a big difference if they only access Hacker News for the latest and trendiest node framework or if you actively research the comments about articles how your country does something bad.

marcosdumay 9y ago

Have you seen those Intel-ME vulnerabilities that were on the front page yesterday and people kept saying they were not as bad as they look, because an attack would need to come from your LAN? Injecting some Javascript into your static, non-sensitive pages is a great way to start an attack from inside your LAN.