22 ms·
Why No HTTPS?
- robinduckett 8y agoBBC.com does have HTTPS, they support http for older clients I assume. They still had a WAP site as far as I recall.
- b2ccb2 8y agoThe https request gets redirected to http: curl -IL https://www.bbc.com HTTP/2 302 content-type: text/html date: Tue, 24 Jul 2018 08:55:34 GMT location: http://www.bbc.com/ content-length: 0 HTTP/1.1 200 OK Server: Apache Content-Type: text/html Expires: Tue, 24 Jul 2018 08:56:35 GMT Content-Language: en …
- toomanybeersies 8y agobbc.com is http only for me. It redirects me to http if I try https.
- jayflux 8y agoThere is work undergoing to migrate bbc.com to HTTPS. Most BBC sites in the UK have already been switched over the past few months. https://www.bbc.co.uk/news https://www.bbc.co.uk/news was finished about a month ago. The BBC is a complicated beast and these sort of things take longer than you would think. We redirect to http in the meantime to not have both being indexed.
- jlengrand 8y agoThat's weird. If I browse some of the sites in the list, I do see them secure.... Example : http://www.leboncoin.fr/ http://www.leboncoin.fr/ redirects to https://www.leboncoin.fr/ https://www.leboncoin.fr/
- iliaznk 8y agoSo do I, I guess an automatic redirection to https from http is expected.
- Aissen 8y agoThe real title should be "Why no HTTPS redirect", but it would be longer. Everything is explained clearly on the website.
- minigab 8y agoIt doesn't work every time for me. If i open it in a new private session (chrome or firefox) there is no redirection... Probably a faulty configuration on their side.
- deleted 8y ago[deleted]
- Scott_Helme_ 8y agoOur accuracy rate is currently around 99.6% so we're doing pretty well but of course I don't think it can ever be 100% either. The biggest thing we've come across so far is geo-sensitive handling of requests. Some sites will redirect you to HTTPS or not based on where you are making the request from! This of course means you might see HTTPS and we see HTTP. I think it's still fair to include those sites in this case because they aren't serving all traffic securely.
- jlengrand 8y agoHey, thanks for the extra insight, I do appreciate. Interesting to know that those sites show these behaviours too. Why could geo-location based redirect be interesting?
- Kartificial 8y agoJudging by the contents of the list for the Netherlands, we are doing quite well: https://whynohttps.com/country/nl https://whynohttps.com/country/nl Most pressing ones are uva.nl (major University) and at5.nl (local but relatively large news site).
- sdoering 8y agoIn Germany I thought if kind of sad, that a major automotive forum isn't https secured (motortalk.de). I was asking myself, how they manage their user's logins. Then I checked. The are secured. Not sure since when, but maybe the data from whynohttps isn't as fresh as one might think. And lot of bigger press sites (spiegel.de, faz.net. computerbild.de) aren't secured still. Kind of a shame imho.
- mstolpm 8y agoThe main reason for big media sites and forums not being https secured is the interest of the advertising community. There was a huge community discussion on sites like golem.de and Heise.de, which only recently switched to https. Login pages are protected almost all the time.
- sebazzz 8y agoThat still keeps the session and login cookie vulnerable right?
- CiTyBear 8y agoWhy no https ? I think we know why...
- paublyrne 8y agoWhy?
- ewiewi 8y agoThey probably meant that the reason is malicious, to spy on traffic. Especially since a good chunk of the top sites on that list are Chinese which is known to have generalised spying on internet users.
- pbhjpbhj 8y agoGeneralised spying, like USA and UK? We're just seemingly more covert about it.
- Rjevski 8y agoHowever, in a shitty regime like China, surely the government can ask the websites to just hand over the private keys and disable prefect forward secrecy, allowing government spying while preventing anyone else from doing so.
- Scott_Helme_ 8y agoWhich is insanely difficult to do at scale and would take a considerable amount of time and resources. Not to mention being really obvious! I'm happy with making things crazy hard for the bad actors out there.
- sonnyblarney 8y agoThe 'web' is kind of for the commons, but HTTPS is just a few steps away from being 'easy'. The steps required are frankly just a little too weird and ugly. Most people making web sites, even many devs, don't necessarily want to, or have the wherewithal to deal with SSL. Setting up SSL on AWS recently was a monster pain the rear for our little nothing project site, granted a lot of that was AWS oriented. It needs to be easier, if it were easy, everyone would be doing it.
- lucideer 8y ago> many devs, don't [...] have the wherewithal to deal with SSL. I can buy this for a non-dev clicking "Install Wordpress" in a legacy cpanel of a cheap shared web host (though in that case the web host should be setting up certs automatically for them), but what exactly is complicated about setting up certs for a dev? https://certbot.eff.org/ https://certbot.eff.org/ holds your hand through the entire ~30 second process. It's simpler than most other tasks a dev needs to do while setting up a website.
- pbhjpbhj 8y agoI use a cheap shared web host. My current and previous host both have LetsEncrypt implementations that take a couple of clicks. The former one was just default cpanel I think. It is difficult if you want to understand the process, though no more so than, say, using Git IMO. In short cpanel and other shared host panels make it as easy as the clicky-clicky Wordpress install
- jfk13 8y ago> It is difficult if you want to understand the process, though no more so than, say, using Git IMO. Given how arcane and confusing anything beyond the most basic Git usage can get, that's hardly a glowing endorsement. :)
- lucideer 8y agoI agree, I found that comparison a bit odd. Certbot is many many orders of magnitude easier to use than Git, and that's even if you need to "use" it beyond the run-once-and-forget standard use-case
- vqrs 8y agobaidu and google.cn are high up on the list of non-HTTPS sites. google.cn is an interesting one though: It redirects HTTPS to http, but the site consists of an image that redirects to google.com.hk which is https-only. Who knows what you see in China when accessing google.cn...
- popotamonga 8y agoI know nothing of https. I put my sites on free cloudflare and i get https without having to do anything, is that enough or?
- r1ch 8y agoUnfortunately not. If you aren't setting up HTTPS at your origin then the connection still goes unencrypted over the internet. Full (Strict) is the only secure SSL option at Cloudflare.
- leni536 8y agoNote that the "Flexible SSL" and even the "Full SSL" options don't protect the traffic between your server and Cloudflare. You you need to enable "Full SSL (strict)" as your SSL setting for that.
- Maakuth 8y agoHowever, he is getting quite a sizable portion of all the security benefits on HTTPS even with the current setup. I think it's quite a bit better than plaintext http all the way. Troy Hunt has written well about this: https://www.troyhunt.com/cloudflare-ssl-and-unhealthy-security-absolutism/ https://www.troyhunt.com/cloudflare-ssl-and-unhealthy-securi...
- r1ch 8y agoYou get a few benefits (protection against local interception) but it comes with a significant downside as it takes away the ability for an end user to identify if the connection is actually secure. For example I wouldn't enter my card details or other personal info on a HTTP site, but when CF is in front of it, I have no way of knowing if that's strict HTTPS to the origin or if most of the connection goes insecurely over the internet. The other problem is that CF makes it very easy for less technical website owners to click a button, see a green lock and assume everything is fine.
- kuahyeow 8y agohttps://whynohttps.com/country/nz https://whynohttps.com/country/nz Ouch number 5 in NZ is a Credit card payment gateway
- toomanybeersies 8y agoIn their defense, they don't offer payments through the site. Their actual payment gateway (sec.paymentexpress.com) is secured with https [1]. I'd be more concerned with the ecommerce sites on the list, like Rebel Sport. Kmart at least does seem to redirect to HTTPS. [1] http://paymentexpress.com/merchant-ecommerce-pxpay.html http://paymentexpress.com/merchant-ecommerce-pxpay.html
- moviuro 8y ago...which is completely stupid because they score A+ on SSLlabs [0]. They even have HSTS etc., they really just have to preload it + add a 301 redirect. [0] https://www.ssllabs.com/ssltest/analyze.html?d=paymentexpress.com https://www.ssllabs.com/ssltest/analyze.html?d=paymentexpres...
- sebazzz 8y agoYes, but if you can midm the http connection you can appear the main site however you like. Including some login format or other way to obtain sensitive data.
- hkai 8y agoNice to know that a bank, Sberbank, doesn't bother to use HTTPS.
- alainchabat 8y agohttps://whynohttps.com/country/tw https://whynohttps.com/country/tw. Taiwan, Province of China. Taiwan is a country. This would be the correct wording: Republic of China. China used its influence at the UN to have that included in ISO: https://en.wikipedia.org/wiki/ISO_3166-1#Naming_and_dispute https://en.wikipedia.org/wiki/ISO_3166-1#Naming_and_dispute
- ekianjo 8y agoits not just the UN. Almost no country recognizes Taiwan as a sovereign state. No embassies in Taiwan. That is really weird but that is the current diplomatic situation.
- philliphaydon 8y agoSimply not true. Most countries recognise Taiwan. But you cannot deal with China if you say that out loud.
- ekianjo 8y agoWhat is your source for your claim?
- philliphaydon 8y agohttps://en.m.wikipedia.org/wiki/One-China_policy https://en.m.wikipedia.org/wiki/One-China_policy It’s called the one China policy. I.e strong arm governments to not recognise Taiwan in order to do business with China.
- slaymaker1907 8y agoI think both Taiwan and China officially say Taiwan is a province. Where they disagree is over which government is the legitimate central government of China.
- philliphaydon 8y ago
- air7 8y agoIt's worth noting that HTTP->HTTPS redirect is, in some sense, game-over already. A malicious actor upstream can mitm by blocking the redirect and providing an HTTP version to the client while communicating HTTPS to the server. sslstrip is one implementation.
- stereo 8y agoThat's why HSTS preloading is what you want to achieve. We've recently added openstreetmap.org and it was a fun project to make sure that everything would properly reply over https.
- repsilat 8y agoIf it gets the https version into your browser history it can prevent a MITM in the future, though. Not all bad.
- Scott_Helme_ 8y agoIndeed the HTTP -> HTTPS redirect is only the first step in solving the problem. A 301 redirect will offer some lasting protection as it can be cached but it's not really that great. The goal here is to take the first step to get on HTTPS and then longer term the sites can consider HSTS and eventually preloading.
- Scott_Helme_ 8y agoIt might also be useful to note I have a HSTS Cheat Sheet for more info: https://scotthelme.co.uk/hsts-cheat-sheet/ https://scotthelme.co.uk/hsts-cheat-sheet/
- dwheeler 8y agoA quick solution that solves many cases is to also use HTTP Strict Transport Security (HSTS), and declare it for at least a year. Then once the user visits the site (say from home) and gets the HSTS header, later visits in that time will always use HTTPS. This solves the problem in many cases. The best solution is to get your site into the HSTS preload list. You can do that here: https://hstspreload.org/ https://hstspreload.org/ - this adds the site to the Chrome list, and most other major browsers (Firefox, Opera, Safari, IE 11 and Edge) have an HSTS preload list based on the Chrome list. Once that happens and the browser updates, users will always use https, even if they ask for http.
- oblio 8y agoHe he, this is quite funny: https://whynohttps.com/country/ro https://whynohttps.com/country/ro Sites 1, 2, 3 are for pirating movies and TV shows :))))
- repsilat 8y agoWhen I'm on free airport wifi they'll often limit the session to half an hour and then start MITMing your traffic to try to bounce you back out to the sign-in page to agree to the terms and conditions again. When that happens, the redirect won't work if you're trying to browse to an HTTPS URL. Worse, for many sites you can't tell your browser to "just go along with the MITM" because of HSTS. So in airports I rack my brain for a website that might serve content over HTTP, not HTTPS. Alas, they're getting harder to find, and it's getting harder to keep those airport wifi sessions going. I half considered registering "alwaysinsecure.com" or "alwayshttp.com" so I could reliably find one... Now I'll probably just use qq.com, it's short and easy to remember. EDIT: Thanks all :-)
- ribasushi 8y agoneverssl.com ( not a suggestion, it does exist )
- pascoej 8y agocaptive.apple.com
- glenjamin 8y agohttp://neverssl.com/ http://neverssl.com/ is what you're looking for here.
- sebazzz 8y agoI just use example.com
- bogomipz 8y agoInteresting. What the prescription here - to simply use http://neverssl.com http://neverssl.com in order to see if you need to re-authenticate to the captive portal? Is that correct?
- pohl 8y agoThat's my interpretation of what http://neverssl.com http://neverssl.com says. (Did you click-through to read it?)
- mabynogy 8y agoI'm opposed to HTTPS everywhere because it comes with a lot of code (like openssl) and a complicated paradigm (pki). We can do better and simpler at the same time.
- vqrs 8y ago> We can do better and simpler at the same time. How?
- mabynogy 8y agoI'm not into crypto but I found that method: https://en.wikipedia.org/wiki/One-time_pad https://en.wikipedia.org/wiki/One-time_pad
- lifthrasiir 8y agoOne-time pad requires a pre-shared key of the enomorous length to be effective in the World Wide Web. An impossible plan can be vacuously better and simpler at the same time, guaranteed.
- mabynogy 8y agoOnly the length of the message.
- ectospheno 8y agoThe issue with one time pads isn't their security. That's fine. The issue is key management. Both parties need the same key and it has to be at least as large as the data you want to send. Each set of parties needs a different key. If you had a method to securely transmit such keys then you could just transmit your data over it instead. This is why one time pads are only used by countries to communicate with staff overseas. You can send the pads by diplomatic courier for use in communication later. There is no equivalent mechanism for your web activity and every site on earth.
- Rjevski 8y agoA nice list of sites to avoid.
- TheBobinator 8y agoGoogle is the major player pushing everyone to encrypt with HTTPS with other companies hopping on board. They argued a populist viewpoint with what Snowden revelaled they need to protect the public, but the real reason they pushed HTTPS so hard has more to do with protecting their business and getting more metadata. It's no secret ISP's are consolidating and being bought up by media conglomerates who want to secure the distribution method for their product and exclude competitors in a new market. Those companies view the internet like they view cable TV; it exists to deploy entertainment and advertising to the public and to convert people into products for companies. But they need a mechanism to figure out what is engaging, e.g. Nielsen Ratings. There's only one thing more accurate than the traditional web bug or javascript running on a webpage, and that's actually MITMing the traffic and extracting the data raw. If you own the ISP you can do this. You can also inject ad's. Ad's and Rating websites is something Google has built their business on. I'm really sure they have a sour taste in their mouth left over from from google fiber due to the politics of ILECs trying to protect their literal state-granted monopoly. And in all seriousness, with POTS being retired, the government is granting monopolies over last-mile wire to cable co's. So Google decided on the nuclear option: they've decided we're just going to get everyone to encrypt their traffic and not just with easily SSLStrip able stuff. We're going to push the standards organizations to deploy SSL\TLS in a way nobody can crack it, then we're going to provide resources like Lets Encrypt to make getting keys cheap, and then we're going to be beligerant whenever the government complains about not being able to get at the traffic. Now all the ISP's can see are HTTPS connections to AWS, Azure and Google on their equipment; using IP's to try to figure out what site is what doesn't work. They can still attempt to MITM the traffic and replace keys and impersonate key repo's and I'm sure in a lot of cases they do, however, that opens them up to class action lawsuits and criminal hacking charges. You don't want a citizen organization charging your network architect with violating the wiretap act; Network Architects are hard enough to work with, give them a reason to tell their employer they are not going to commit a crime, and they'll end up fighting their employers tooth and nail. Both of which I'm sure Google would be more than happy to fund to protect its business. The other advantage you get out of HTTPS is the session re-use feature. When someone re-connects to your webpage, instead of establishing a new connection, they can re-use the session they had before; this reliably tags a device and allows you to identify connections from a device even when IP's are changing, and would be more accurate than a browser fingerprint. This is not a new technology or mechanism; IPSEC IKE sessions can last years. In all candor, we've got military-grade encryption protecting general internet traffic at this point and everyone on this forum is going to argue about privacy without understanding where the market is at or why. That speaks volumes to the times we live in and how effective astroturfing and misinformation campaigns are.
- dvfjsdhgfv 8y agoThere is a good dissection of these popular arguments in favor of HTTPS on static websites that don't have any forms: http://webcache.googleusercontent.com/search?q=cache:Ka_e9-V0fB8J:n-gate.com/software/2017/07/12/0/ http://webcache.googleusercontent.com/search?q=cache:Ka_e9-V... In short: I have yet to see a really convincing argument in favor of HTTPS in these scenarios.
- Scott_Helme_ 8y agoHave a look at this post: https://www.troyhunt.com/heres-why-your-static-website-needs-https/ https://www.troyhunt.com/heres-why-your-static-website-needs...
- steventhedev 8y agoPlease put yourself in the shoes of someone actually operating a site. Every single issue mentioned in that post only affects end-users. Not a single issue for the operator, who has many other issues that are more urgent such as turning a profit, securing that database that got wiped last week, and writing actual content. Point being that the incentive to force https for a static site for an individual site operator is just not that great. The sad reality is that http->https redirects are like vaccination. In some specific cases they are needed (such as login pages), but for some it's more about herd-immunity (normalizing https usage and ensuring availability). Mind you that there's a solid argument for allowing self-signed certs to allow encrypted but unauthenticated transfer. This mode allows MitM, yet does protect against the threat model of a passive eavesdropper.
- Scott_Helme_ 8y ago"Please put yourself in the shoes of someone actually operating a site." - I run 8 sites right now and one of them is processing 10,000,000,000+ requests a month. I speak from a position of experience on this topic. "Every single issue mentioned in that post only affects end-users. Not a single issue for the operator" - so don't care about the user and the risks we expose them to, only ourselves? This isn't really an approach I'm happy taking.
- rurcliped 8y agoI have public content that I'm willing to share over the web. To offer it over HTTP, I only need a few thousand lines of code on top of TCP. It's realistic to prove that that code has no memory-safety problems. To offer it over HTTPS, I need to add tens of thousands of lines of extra code related to cryptography. No existing implementation is known to be correct. The popular implementations don't have a strong history of code quality. It's completely reasonable to expect that, over time, new vulnerabilities will be found that will allow attackers to read or write to unintended memory locations on my server. I totally understand that, by adding a popular but historically unsafe cryptography implementation, I can help web clients to avoid MITM shenanigans while reading my content. MITM indeed is a problem. But, I'm not willing to make that my problem. The vast majority of my customers don't experience MITM data modification while reading my content. The vast majority of my customers wouldn't care if the whole world knew that they have read my content. Perhaps in the future, code for all the required cryptography layers will be just as provably correct as code for reading the cleartext HTTP protocol. When that day comes, I will add HTTPS. Not before.
- bfred_it 8y agoI don’t follow. 1. You don’t have to write any code to use HTTPS, it has already been written. 2. Are you saying that since HTTPS isn’t perfectly secure you’re gonna use the definitely insecure HTTP? What kind of logic is that?
- xamuel 8y agoFrom a purely selfish perspective: HTTP worst case: your reader is harmed. HTTPS worst case: you yourself are harmed (e.g., if someone finds a zero-day in a cryptography library and uses it to run arbitrary code on your server)
- UncleMeat 8y agoYeah because nobody has ever found rce bugs in other parts of the http server infra. The only way people get rce on your box is by exploiting tls libs. Right.
- taf2 8y agoWhat's the point of encrypting the sites in China anyway? I mean obviously everything you do online in China is tracked and not only that but shared - so is it maybe better in China to just not encrypt to safe on the additional power consumption? Really good green policy in China :D
- zokier 8y agoState actors are not the only threats
- taf2 8y agoI means it’s more about local corruption in China right which is driven by perverse economic pressures that come from an overbearing centerialized government power.
- supertrope 8y agoIt's doing something. After Google deployed TLS and obviously did not obey government data requests the government blocked Google domains entirely. Kind of like how Russia blocked Wikipedia entirely because TLS does not allow fine grained per page blocking.
- rc_bhg 8y agoI mean on some sites I make, I just don't care if its encrypted. I hate that I have to just because all you mofo's have forced me.
- mlfn 8y agoWho's forcing you?
- donatj 8y agoChrome, mostly.
- filleduchaos 8y agoHow is Chrome forcing you to implement HTTPS on your server?
- andyjh 8y agoChrome isn't forcing anyone, it's just making it clear to users that a non-https site is insecure, which it is. What's the problem with providing information so that users can make an informed choice about whether to use the site?
- diafygi 8y agoAnd I hate the fact that I can't trust the network to not modify your sites when I visit them. So I guess we can both be mad together. Remember that https offers both privacy and integrity, so even if you don't care about the privacy, you should care about the integrity.
- whorleater 8y ago>you should care about the integrity I mean, there's the option to not use my site. Can I take a stand against HTTPS because I believe PKI to be a dumpster fire?
- 8y ago
- kanox 8y agoI expected more porn.
- Scott_Helme_ 8y agoI expected less to be honest. The adult entertainment industry has been on a huge drive to encryption recently. It makes sense if you think about the content they serve, I guess people want more privacy there!
- sp332 8y agot.co is an unusual one. It's a link shortener that produces an https link if you give it an https link, or an http link if you give it an http link. At least I think that's how it worked but I'm having a hard time testing it now.
- creeble 8y agoI can recommend another site a just used yesterday for finding all the broken (http:// http://) image references is https://www.whynopadlock.com https://www.whynopadlock.com The site I was debugging was a WordPress site that had somehow gotten the images in its opening carousel set to http:// http:// despite the fact that the "header" module had a default of https:// https://. Very useful to just feed it the URL and notice these were the broken images; I could have grep'd through a "show source" page, but whynopadlock.com made it easy for me to identify that it was the header module of a site for which I had little familiarity.
- gok 8y agotldr: China
- cordite 8y agoWhy is Puerto Rico marked as a country at the bottom?
- kevrone 8y agoYou can figure out your own certs or manage the cert request/verification cycle via Let's Encrypt...or you can let someone else do it for you. I recently joined a company that offers HTTPS out of the box for any domain you own: https://blog.backplane.io/how-to-get-https-80e1b28b878c https://blog.backplane.io/how-to-get-https-80e1b28b878c I'm biased, but I do think it's a pretty painless way to enable HTTPS for sites both big and small. No uploading of certs, no modifications to your web app are necessary, it just works.
- MrXOR 8y agoAnother (very) bad news: only 17.7% of HTTPS sites support HTTP Strict Transport Security (HSTS) == 82.3% of HTTPS sites are HTTP!!! https://www.ssllabs.com/ssl-pulse/ https://www.ssllabs.com/ssl-pulse/