4 ms·

Since when is https mandatory? And which kind of power we give to cert auth (except money if you are not using letsencrypt)?

y4mi 8y ago
It's mandatory with http/2. Even http/1 (which is mostly used atm ) flags any page with inputs with a big red !! Insecure !!
- JohnFen 8y ago
  > Even http/1 (which is mostly used atm ) flags any page with inputs with a big red !! Insecure !! That doesn't make it mandatory.
  - y4mi 8y ago
    You missed the first sentence of my comment.
    - JohnFen 8y ago
      I didn't miss it. I was just responding to the HTTP/1 part.
      - paulddraper 8y ago
        That's why y4mi said "Event with..." HTTP/1 clients push TLS; HTTP/2 mandates TLS.
        JohnFen 8y ago
        Yes, I know. That didn't escape me. My response was in the context of Lorenz-Kraft's comment. I've been trying to be more brief in my comments here, since I tend to ramble on too much. I think perhaps I was too brief this time.
- pwinnski 8y ago
  That depends on which browser you use.
- Wowfunhappy 8y ago
  > Even http/1 (which is mostly used atm ) flags any page with inputs with a big red !! Insecure !! If you're using Google Chrome. Safari and Firefox don't do this (yet?) unless the page also has a password field. Which seems like the right compromise IMO.
  - tinus_hn 8y ago
    Safari on iOS marks a page ‘Not secure’ in the address bar if it’s served over http.
    - Wowfunhappy 8y ago
      Not on my iPhone! I just checked to make sure! Unless there's a password field on the page, as I stated.
      - ehPReth 8y ago
        Are you on the latest iOS? I’m on 12.2 on an iPhone XS and see it when going to http://example.com/ http://example.com/ and http://neverssl.com/ http://neverssl.com/
        Wowfunhappy 8y ago
        I'm on 12.1.1, so I guess they changed it very recently...
IshKebab 8y ago
https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts/features_restricted_to_secure_contexts https://developer.mozilla.org/en-US/docs/Web/Security/Secure...
quickthrower2 8y ago
It's hard to justify not having https on any site. Without it you are saying "you might get the intended HTML we sent ... or maybe not if the request has been intercepted". Any other encryption system is not natively supported by the browser so would require some kind of plug in. How would you download that plugin? https? Using JS to encrypt is a problem because you need to securely download that JS to begin with, requiring https or similar.

y4mi 8y ago

It's mandatory with http/2. Even http/1 (which is mostly used atm ) flags any page with inputs with a big red !! Insecure !!

JohnFen 8y ago
> Even http/1 (which is mostly used atm ) flags any page with inputs with a big red !! Insecure !! That doesn't make it mandatory.
- y4mi 8y ago
  You missed the first sentence of my comment.
  - JohnFen 8y ago
    I didn't miss it. I was just responding to the HTTP/1 part.
    - paulddraper 8y ago
      That's why y4mi said "Event with..." HTTP/1 clients push TLS; HTTP/2 mandates TLS.
      - JohnFen 8y ago
        Yes, I know. That didn't escape me. My response was in the context of Lorenz-Kraft's comment. I've been trying to be more brief in my comments here, since I tend to ramble on too much. I think perhaps I was too brief this time.
pwinnski 8y ago
That depends on which browser you use.
Wowfunhappy 8y ago
> Even http/1 (which is mostly used atm ) flags any page with inputs with a big red !! Insecure !! If you're using Google Chrome. Safari and Firefox don't do this (yet?) unless the page also has a password field. Which seems like the right compromise IMO.
- tinus_hn 8y ago
  Safari on iOS marks a page ‘Not secure’ in the address bar if it’s served over http.
  - Wowfunhappy 8y ago
    Not on my iPhone! I just checked to make sure! Unless there's a password field on the page, as I stated.
    - ehPReth 8y ago
      Are you on the latest iOS? I’m on 12.2 on an iPhone XS and see it when going to http://example.com/ http://example.com/ and http://neverssl.com/ http://neverssl.com/
      - Wowfunhappy 8y ago
        I'm on 12.1.1, so I guess they changed it very recently...

IshKebab 8y ago

https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts/features_restricted_to_secure_contexts https://developer.mozilla.org/en-US/docs/Web/Security/Secure...

quickthrower2 8y ago

It's hard to justify not having https on any site. Without it you are saying "you might get the intended HTML we sent ... or maybe not if the request has been intercepted". Any other encryption system is not natively supported by the browser so would require some kind of plug in. How would you download that plugin? https? Using JS to encrypt is a problem because you need to securely download that JS to begin with, requiring https or similar.