5 ms·

You're asking the wrong question, like many others who are resistant to HTTPS everywhere. HTTPS isn't for you, the site owner (although you gain the not insigni

You're asking the wrong question, like many others who are resistant to HTTPS everywhere. HTTPS isn't for you, the site owner (although you gain the not insignificant benefit of knowing your content and traffic is untampered with). It's for the people that visit your site, so when you say HTTPS is a waste of effort and resources what you're inadvartently saying is that you don't give a fuck about your visitors - or at least, not enough of one to do the least you can to protect them from people who want to track and/or tamper with their browsing activity[1]. Especially since solutions like Let's Encrypt with certbot are free and take a couple of commands to set up. [1] Unencrypted, pretty much everything about your internet traffic is laid bare for any middleman - your ISP, the person who controls the router you're connected to, some script kiddie on the same network as you - to both read and write. Injecting ads or cryptominers, tracking what pages you visit, changing what a page says, even straight up serving a different page. Why let your site/server be a (potential) vehicle for exploitation, disinformation and privacy invasion?

dragontamer 8y ago
If the user is so paranoid about this sort of stuff, then they can go get a VPS and control a large chunk of the network for themselves. For everyone else, its a game guide. The worst that can happen is that they get the wrong information about how Trains work in Factorio. There wouldn't be a need for me to track users or clicks or whatever in a hypothetical game guide community website. As I stated before: I know some game communities (ie: Minecraft or Eve Online) can be toxic. But the Factorio community isn't like that. So I'd be comfortable hosting a Factorio webpage under HTTP. If I were hosting a Minecraft or Eve webpage however (warning: toxic community ahead), then I'd host it under HTTPS due to the dastards who troll and harass others in that community. ---------- That's the more important part btw: understanding your audience. Some game communities are toxic and full of harassers, trolls and so forth. But other communities are lax, friendly, and can get away with lesser amounts of security.
- supertrope 8y ago
  The worst that can happen is malware Javascript, phishing re-directs are injected. Of course if the page itself has ad networks those are there by design.
  - dragontamer 8y ago
    Phishing for what though? If it were a big network, like GameFAQs, Reddit, or you know, something where you can steal a password or something. Maybe you'd have a point. But random blog with a bit of information on the game?? http://factorioguide.nfshost.com/ http://factorioguide.nfshost.com/ Real story btw. I'm paying a bit of money for the host (not much though), I don't believe in ads taking money from the few reads I do get. Its basically a static page that costs pennies. I'm no longer updating the webpage, but I'm leaving it up just in case someone out there wants to learn more about the game. (It doesn't seem like any of the information is out-of-date. Its a few years old but the game hasn't changed in this aspect, so the information is still solid). I just don't see any point converting this webpage into HTTPS. There's literally nothing to phish here.
    - supertrope 8y ago
      Credit card numbers, Social Security numbers, online banking credentials, etc. The usual target data in fake tech support phishing scam. example screenshot: https://www.pcrisk.com/images/stories/screenshots201703/zeus-virus-detected-scam-variant4.jpg https://www.pcrisk.com/images/stories/screenshots201703/zeus...
      - dragontamer 8y ago
        Okay, I get what you're saying then. Your example isn't exactly the best example... but I "get" what you're trying to say at least. You're saying that someone can inject a "redirect header" into a fake webpage, force that upon my users through the control of a network (WiFi router or whatnot), and use my domain name and my trust to take advantage of the users. (Your example with the Zeus malware is bad because Zeus attacked the OS directly, so it wasn't a network attack. But hypothetically, lets say it was a network attack so that it remains applicable to my example) Alas, HTTPS does NOT solve that, at least not while globally trusted HTTPS certificate roots remain insecure. They only need to get one HTTPS certificate signed by Comodo (or some other low-security HTTPS vendor) to attack my domain name in a manner like that.
- joepie91_ 8y ago
  > If the user is so paranoid about this sort of stuff, then they can go get a VPS and control a large chunk of the network for themselves. And the last mile is still going to be just as unencrypted, non-private, and tamperable as before. You literally cannot get end-to-end encryption/privacy without the host supporting TLS. It's really not an optional thing to support for you as an operator, and especially now that Let's Encrypt is a thing, there's really no excuse for not doing it. (Now that we're on the subject of toxicity anyway: I'd say that depriving your users from the ability to secure their network traffic, just because you're trying to die on a weird hill, is pretty toxic behaviour.)
  - dragontamer 8y ago
    If I had usernames / passwords, then I'd use TLS. But some webpages are simple, static one-off projects that I put out on behalf of a community. I don't believe in ads and would rather pay for all the bandwidth that my users would use. Consider it a donation "for the love of the game". Very, very simple, nearly static webpages, close to "neocities" level of web design. No users, no passwords, just information I'm publishing to help a game community out. Nothing to steal, nothing to phish, nothing. Pure text, maybe a few images and videos to elaborate on specific points. http://factorioguide.nfshost.com http://factorioguide.nfshost.com ---------- I understand that TLS is important for any website with interactivity for privacy reasons. But the above webpage is completely static and non-interactive. Its old-school Web 1.0 stuff. There's nothing to steal, phish, or cheat here. Literally nothing. I just don't see the point in HTTPS-ing this site.
    - joepie91_ 8y ago
      > I understand that TLS is important for any website with interactivity for privacy reasons. Then you understand wrong. It's important for any website, interactive or not, for privacy reasons. Reader privacy is a thing regardless of whether something is interactive. I don't know where you're getting the idea from that 'static' sites are somehow special.
      - dragontamer 8y ago

dragontamer 8y ago

If the user is so paranoid about this sort of stuff, then they can go get a VPS and control a large chunk of the network for themselves. For everyone else, its a game guide. The worst that can happen is that they get the wrong information about how Trains work in Factorio. There wouldn't be a need for me to track users or clicks or whatever in a hypothetical game guide community website. As I stated before: I know some game communities (ie: Minecraft or Eve Online) can be toxic. But the Factorio community isn't like that. So I'd be comfortable hosting a Factorio webpage under HTTP. If I were hosting a Minecraft or Eve webpage however (warning: toxic community ahead), then I'd host it under HTTPS due to the dastards who troll and harass others in that community. ---------- That's the more important part btw: understanding your audience. Some game communities are toxic and full of harassers, trolls and so forth. But other communities are lax, friendly, and can get away with lesser amounts of security.

supertrope 8y ago
The worst that can happen is malware Javascript, phishing re-directs are injected. Of course if the page itself has ad networks those are there by design.
- dragontamer 8y ago
  Phishing for what though? If it were a big network, like GameFAQs, Reddit, or you know, something where you can steal a password or something. Maybe you'd have a point. But random blog with a bit of information on the game?? http://factorioguide.nfshost.com/ http://factorioguide.nfshost.com/ Real story btw. I'm paying a bit of money for the host (not much though), I don't believe in ads taking money from the few reads I do get. Its basically a static page that costs pennies. I'm no longer updating the webpage, but I'm leaving it up just in case someone out there wants to learn more about the game. (It doesn't seem like any of the information is out-of-date. Its a few years old but the game hasn't changed in this aspect, so the information is still solid). I just don't see any point converting this webpage into HTTPS. There's literally nothing to phish here.
  - supertrope 8y ago
    Credit card numbers, Social Security numbers, online banking credentials, etc. The usual target data in fake tech support phishing scam. example screenshot: https://www.pcrisk.com/images/stories/screenshots201703/zeus-virus-detected-scam-variant4.jpg https://www.pcrisk.com/images/stories/screenshots201703/zeus...
    - dragontamer 8y ago
      Okay, I get what you're saying then. Your example isn't exactly the best example... but I "get" what you're trying to say at least. You're saying that someone can inject a "redirect header" into a fake webpage, force that upon my users through the control of a network (WiFi router or whatnot), and use my domain name and my trust to take advantage of the users. (Your example with the Zeus malware is bad because Zeus attacked the OS directly, so it wasn't a network attack. But hypothetically, lets say it was a network attack so that it remains applicable to my example) Alas, HTTPS does NOT solve that, at least not while globally trusted HTTPS certificate roots remain insecure. They only need to get one HTTPS certificate signed by Comodo (or some other low-security HTTPS vendor) to attack my domain name in a manner like that.
joepie91_ 8y ago
> If the user is so paranoid about this sort of stuff, then they can go get a VPS and control a large chunk of the network for themselves. And the last mile is still going to be just as unencrypted, non-private, and tamperable as before. You literally cannot get end-to-end encryption/privacy without the host supporting TLS. It's really not an optional thing to support for you as an operator, and especially now that Let's Encrypt is a thing, there's really no excuse for not doing it. (Now that we're on the subject of toxicity anyway: I'd say that depriving your users from the ability to secure their network traffic, just because you're trying to die on a weird hill, is pretty toxic behaviour.)
- dragontamer 8y ago
  If I had usernames / passwords, then I'd use TLS. But some webpages are simple, static one-off projects that I put out on behalf of a community. I don't believe in ads and would rather pay for all the bandwidth that my users would use. Consider it a donation "for the love of the game". Very, very simple, nearly static webpages, close to "neocities" level of web design. No users, no passwords, just information I'm publishing to help a game community out. Nothing to steal, nothing to phish, nothing. Pure text, maybe a few images and videos to elaborate on specific points. http://factorioguide.nfshost.com http://factorioguide.nfshost.com ---------- I understand that TLS is important for any website with interactivity for privacy reasons. But the above webpage is completely static and non-interactive. Its old-school Web 1.0 stuff. There's nothing to steal, phish, or cheat here. Literally nothing. I just don't see the point in HTTPS-ing this site.
  - joepie91_ 8y ago
    > I understand that TLS is important for any website with interactivity for privacy reasons. Then you understand wrong. It's important for any website, interactive or not, for privacy reasons. Reader privacy is a thing regardless of whether something is interactive. I don't know where you're getting the idea from that 'static' sites are somehow special.
    - dragontamer 8y ago