5 ms·

>it sure is something that offers very little value for very many site owners. Because it's not meant to offer value for a site owner, it's meant to offer valu

>it sure is something that offers very little value for very many site owners. Because it's not meant to offer value for a site owner, it's meant to offer value to the user. When I type a password on your website, I'm the one that has the most to lose there. When I type my credit card or other personal information into a site, I'm the one that will need to spend time and money getting control of my information if it was stolen. When I am browsing the web and ads are being injected into the HTTP request, or my ISP is dragnet datamining, or a compromised router is injecting malware into every page, I'm the one that loses, not you. The argument that an insecure website is easier to maintain than a secure website is like saying "a car without airbags is easier to work on". The extreme vast majority don't care about how easy it is to maintain the site, they care about their privacy and security. And your counterpoint is needing to download and run some open-source software once a month (or automate the process and never touch it again). A few years ago that would have been a much larger list, but developers were listening to the complaints, and realized that the only way to a fully secure web was to make this process easier, so they did! It's easier than ever to enable HTTPS on every website, and in the vast majority of cases it's a net improvement for users.

drdeca 9y ago
Well, ok, but what about the websites that don't have ads or logins or other personal information?
- UncleMeat 9y ago
  Integrity. HTTPS prevents scripts from being inserted into a page, which is still a problem even for static content that includes no forms.
- Klathmon 9y ago
  I think you misunderstand. An ad-free website served over HTTP can (and does) have ads injected into it by someone along the way. And not just ads, but malware as well. And privacy of information going from your browser to the internet is only half of the equation. What about privacy about what you are viewing? I don't want every single router between my computer and the server knowing the full contents of the pages I'm choosing to view, or building advertising profiles on my habits, or even knowing what device type, browser, OS, and more I'm using.
  - josteink 9y ago
    Only if you use a shitty ISP which tries to MITM you. So don’t use a shitty ISP that tries to MITM you. Problem solved. How is that even controversial?
    - Klathmon 9y ago
      But it's not only if you use a shitty ISP. It's if any hop between you and the server is being shitty. And only 1 or 2 of those can you control as the user.
    - pfg 9y ago
      Users often have very little choice when it comes to their ISP. Regional ISP monopolies are very much a thing in many countries.
    - shakna 9y ago
      Having spent four months in a hospital, it isn't just "ISPs" who are the problem. Rather than the hospital supplying any kind of proper authentication, they MITM the first connection to their WiFi, and logged your IP address as your user. They also required you refresh that connection every half hour or so. There are a lot of people doing things in really bad ways. We can't fix all of them, and often we don't have a choice about interacting with them.
      - IncRnd 9y ago
        Yep. That's why the name for any one of these is "captive portal".
  - drdeca 9y ago
    Ah, ok. Would a self-signed (I'm not sure this is the right terminology) cert be sufficient for this? That way if someone MITM'd you, you would see that the cert changed, right? But I guess if the path you use to the website is always the same, then if they MITM'd you the first time you accessed it, you wouldn't be able to tell? Hmm, I guess that probably isn't enough then. Is there really no good way to serve public information from a website that doesn't require periodically updating one's cert, and without risking MITM'ers changing the content? I guess if the client already has the hash of the content, but that isn't very convenient. Huh. I guess example.com needs https then?

drdeca 9y ago

Well, ok, but what about the websites that don't have ads or logins or other personal information?

UncleMeat 9y ago
Integrity. HTTPS prevents scripts from being inserted into a page, which is still a problem even for static content that includes no forms.
Klathmon 9y ago
I think you misunderstand. An ad-free website served over HTTP can (and does) have ads injected into it by someone along the way. And not just ads, but malware as well. And privacy of information going from your browser to the internet is only half of the equation. What about privacy about what you are viewing? I don't want every single router between my computer and the server knowing the full contents of the pages I'm choosing to view, or building advertising profiles on my habits, or even knowing what device type, browser, OS, and more I'm using.
- josteink 9y ago
  Only if you use a shitty ISP which tries to MITM you. So don’t use a shitty ISP that tries to MITM you. Problem solved. How is that even controversial?
  - Klathmon 9y ago
    But it's not only if you use a shitty ISP. It's if any hop between you and the server is being shitty. And only 1 or 2 of those can you control as the user.
  - pfg 9y ago
    Users often have very little choice when it comes to their ISP. Regional ISP monopolies are very much a thing in many countries.
  - shakna 9y ago
    Having spent four months in a hospital, it isn't just "ISPs" who are the problem. Rather than the hospital supplying any kind of proper authentication, they MITM the first connection to their WiFi, and logged your IP address as your user. They also required you refresh that connection every half hour or so. There are a lot of people doing things in really bad ways. We can't fix all of them, and often we don't have a choice about interacting with them.
    - IncRnd 9y ago
      Yep. That's why the name for any one of these is "captive portal".
- drdeca 9y ago
  Ah, ok. Would a self-signed (I'm not sure this is the right terminology) cert be sufficient for this? That way if someone MITM'd you, you would see that the cert changed, right? But I guess if the path you use to the website is always the same, then if they MITM'd you the first time you accessed it, you wouldn't be able to tell? Hmm, I guess that probably isn't enough then. Is there really no good way to serve public information from a website that doesn't require periodically updating one's cert, and without risking MITM'ers changing the content? I guess if the client already has the hash of the content, but that isn't very convenient. Huh. I guess example.com needs https then?