5 ms·

Well, the bank seems to be stuck in the past... 10 years ago it was best practice for ecommerce shops to serve non sensitive pages (pages without forms or user

by JepZ 9y ago

Well, the bank seems to be stuck in the past... 10 years ago it was best practice for ecommerce shops to serve non sensitive pages (pages without forms or user data) without HTTPS to reduce the server load (HTTPS connections are a little more expensive than HTTP). Nowadays, even the economical driven ecommerce shops got it that is better to just serve everything via HTTPS. It is very sad to see a bank (which should really know better) arguing that way.

dazc 9y ago
In the UK there are major ecommerce sites still on HTTP.
- mprev 9y ago
  Major sites, really?
  - dazc 9y ago
    marksandspencer.com very.co.uk asos.com next.co.uk and many more.
    - Jaruzel 9y ago
      Other than shopping privacy, who cares? As long as the checkout and account management pages are https, then I don't see the big issue here. I'm just not one of these people who think there are armies of people at the NSA/GCHQ spying on me. I'm also against forcing every website in the world onto https. Doing so will significantly raise the bar of accessibility for tinkerers and makers. If I had a webcam that showed the world whether my coffee put needed refilling[1], are we all saying (on this thread, and troy hunt) that it needs serving over https because the privacy and security of coffee watchers is such a closely guarded secret that they need to be secure in their coffee pot watching habit? By all means, https up important pages and sites, but lets not make it mandatory to the extent that http is no longer supported by browsers. As an aside... a Barclays bank advert running in the UK at the moment is showing users that 'a padlock in your browser bar ensures that you are safe and that the site you are visiting is who you think it is' - which is utter bullshit, all a padlock tells you is that site owner has spent 5 minutes setting up LetsEncrypt - it in NO way confirms that they are who they say they are, and it's this lie that Joe Public are being sold right now. --- [1] Apparently this was a thing once ;)
      - cesarb 9y ago
        > As long as the checkout and account management pages are https, then I don't see the big issue here. How do you arrive at the checkout and account management pages? By clicking on a link. If the whole site isn't encrypted, the link can be modified to point to false checkout and account management pages. HTTPS is not only for privacy, it's also for integrity.
        Jaruzel 9y ago
        How far do you go down the chain? At some point you'll hit a layer that the internet has no control over - the users machine. You can https every page on every site if you want, but if the users machine is compromised, then it's not going to help one bit. ALL https says is 'hey i'm encrypted' it doesn't PROVE to the end user that it's really who it says it is. Extended Validation was supposed to fix this, but that ended up as an evil money grabbing exercise by the CAs so that didn't get the adoption it needed. Until there's a secure validation banner at the top of the browsers that contains an unfakeable and unbreakable 'this is who I am' statement, then https is just a sticking plaster/bandaid over the whole problem. And for those who say 'https prevents man in the middle attacks' - no it does not. There are several network level devices that by design decrypt/review/encrypt/spoof-cert traffic to clients (WAN Accelerators and Corporate Proxies being good examples) something that can only be overcome by Security Pinning the Certs to IP addresses... but again hardly anyone does that either.
        cesarb 9y ago
        > And for those who say 'https prevents man in the middle attacks' - no it does not. There are several network level devices that by design decrypt/review/encrypt/spoof-cert traffic to clients These network devices (middleboxes) can do that only if the client lets it. As you just said, once the client is compromised, all bets are off. HTTPS by design protects against a compromised network, not against a compromised client.
      - Titi67 9y ago
        Well... you didn't read the article, did you?...

by JepZ 9y ago

dazc 9y ago

In the UK there are major ecommerce sites still on HTTP.

mprev 9y ago
Major sites, really?
- dazc 9y ago
  marksandspencer.com very.co.uk asos.com next.co.uk and many more.
  - Jaruzel 9y ago
    Other than shopping privacy, who cares? As long as the checkout and account management pages are https, then I don't see the big issue here. I'm just not one of these people who think there are armies of people at the NSA/GCHQ spying on me. I'm also against forcing every website in the world onto https. Doing so will significantly raise the bar of accessibility for tinkerers and makers. If I had a webcam that showed the world whether my coffee put needed refilling[1], are we all saying (on this thread, and troy hunt) that it needs serving over https because the privacy and security of coffee watchers is such a closely guarded secret that they need to be secure in their coffee pot watching habit? By all means, https up important pages and sites, but lets not make it mandatory to the extent that http is no longer supported by browsers. As an aside... a Barclays bank advert running in the UK at the moment is showing users that 'a padlock in your browser bar ensures that you are safe and that the site you are visiting is who you think it is' - which is utter bullshit, all a padlock tells you is that site owner has spent 5 minutes setting up LetsEncrypt - it in NO way confirms that they are who they say they are, and it's this lie that Joe Public are being sold right now. --- [1] Apparently this was a thing once ;)
    - cesarb 9y ago
      > As long as the checkout and account management pages are https, then I don't see the big issue here. How do you arrive at the checkout and account management pages? By clicking on a link. If the whole site isn't encrypted, the link can be modified to point to false checkout and account management pages. HTTPS is not only for privacy, it's also for integrity.
      - Jaruzel 9y ago
        How far do you go down the chain? At some point you'll hit a layer that the internet has no control over - the users machine. You can https every page on every site if you want, but if the users machine is compromised, then it's not going to help one bit. ALL https says is 'hey i'm encrypted' it doesn't PROVE to the end user that it's really who it says it is. Extended Validation was supposed to fix this, but that ended up as an evil money grabbing exercise by the CAs so that didn't get the adoption it needed. Until there's a secure validation banner at the top of the browsers that contains an unfakeable and unbreakable 'this is who I am' statement, then https is just a sticking plaster/bandaid over the whole problem. And for those who say 'https prevents man in the middle attacks' - no it does not. There are several network level devices that by design decrypt/review/encrypt/spoof-cert traffic to clients (WAN Accelerators and Corporate Proxies being good examples) something that can only be overcome by Security Pinning the Certs to IP addresses... but again hardly anyone does that either.
        cesarb 9y ago
        > And for those who say 'https prevents man in the middle attacks' - no it does not. There are several network level devices that by design decrypt/review/encrypt/spoof-cert traffic to clients These network devices (middleboxes) can do that only if the client lets it. As you just said, once the client is compromised, all bets are off. HTTPS by design protects against a compromised network, not against a compromised client.
    - Titi67 9y ago
      Well... you didn't read the article, did you?...