3 ms·

I definitely agree there's no excuse not to use TLS anymore. I recently ran into this on a city of Vancouver website for voting information. While any page tha

I definitely agree there's no excuse not to use TLS anymore. I recently ran into this on a city of Vancouver website for voting information. While any page that had a form used HTTPS, all other pages forced the user to use HTTP. Like, for those pages, it redirected to unencrypted even if you typed in https:// https://. Including the page with polling location information. So any malicious actor in a privileged position, like a public WiFi network operator, could have effectively prevented people from getting accurate poll location information, effectively DoSing prospective voters. I tried to bring this to their attention, but I got a response telling me their IT guy says it's not a problem because no user data is submitted on those pages. Never mind that it was probably more work to selectively enable TLS per URL and leaves important content vulnerable to manipulation. Incredible! It's like the old "all of our download links use HTTPS", but the downloads page is served unencrypted. Frustrating.

sildur 8y ago
Maybe all they can afford is a really old or weak server machine, and are afraid of the extra computational power that enabling https on all pages would incur.
- DenseComet 8y ago
  Elliptical curve based keys are now supported by all major browsers and require much less processing power and overhead compared to traditional RSA keys.
lisper 8y ago
> there's no excuse not to use TLS anymore I have a personal site that consists entirely of low-value static assets: http://flownet.com/ron/ http://flownet.com/ron/ Why should I use TLS for that?
- mlazowik 8y ago
  Anyone on the path between your server and clients can change the content however they want. Inject ads, mining scripts, redirect to a phishing website, try to push a virus to your client etc. There are even ISPs that do that: https://security.stackexchange.com/questions/157828/my-isp-bsnl-india-is-injecting-ads-using-phozeca-which-spoils-websites-and-mak https://security.stackexchange.com/questions/157828/my-isp-b... https://thenextweb.com/insights/2017/12/11/comcast-continues-to-inject-its-own-code-into-websites-you-visit/ https://thenextweb.com/insights/2017/12/11/comcast-continues...

sildur 8y ago

Maybe all they can afford is a really old or weak server machine, and are afraid of the extra computational power that enabling https on all pages would incur.

DenseComet 8y ago
Elliptical curve based keys are now supported by all major browsers and require much less processing power and overhead compared to traditional RSA keys.

lisper 8y ago

> there's no excuse not to use TLS anymore I have a personal site that consists entirely of low-value static assets: http://flownet.com/ron/ http://flownet.com/ron/ Why should I use TLS for that?

mlazowik 8y ago
Anyone on the path between your server and clients can change the content however they want. Inject ads, mining scripts, redirect to a phishing website, try to push a virus to your client etc. There are even ISPs that do that: https://security.stackexchange.com/questions/157828/my-isp-bsnl-india-is-injecting-ads-using-phozeca-which-spoils-websites-and-mak https://security.stackexchange.com/questions/157828/my-isp-b... https://thenextweb.com/insights/2017/12/11/comcast-continues-to-inject-its-own-code-into-websites-you-visit/ https://thenextweb.com/insights/2017/12/11/comcast-continues...