9 ms·

HTTPS should be used even for static sites. 1. Privacy matters. A medical website, or indeed Wikipedia, should prevent a snooping ISP from finding out you have

HTTPS should be used even for static sites. 1. Privacy matters. A medical website, or indeed Wikipedia, should prevent a snooping ISP from finding out you have been reading about an embarrassing condition. This is similar to the way librarians are extremely protective of their loan records [0]. Netflix use HTTPS for their streams, for the same reason (it does nothing to aid their DRM, it's purely about privacy) [1]. 2. As someone here already mentioned, it prevents ads/trackers/malware being injected into the page by unscrupulous ISPs (this really has happened [2]) 3. Modern browsers will (rightly) warn users not to trust the site. This makes the site look bad. 4. Some fancy browser features are disabled if you use unencrypted HTTP. Likely irrelevant for a static site though. 5. Let's turn the tables and ask why you wouldn't use HTTPS for a public-facing web server. There are just two reasons: firstly, reduced admin overhead not having to bother with certs, and secondly, it enables caching web proxies, which is only relevant if you're running a serious distribution platform like Steam, or a Linux package-management repo [3] > Why can’t I use my own self-signed certificate, it’s the same thing. It is not. I don't think you understand the role of CAs. Self-signed certs do not provide protection against connecting to an impersonator. [0] https://www.theguardian.com/us-news/2016/jan/13/us-library-records-purged-data-privacy https://www.theguardian.com/us-news/2016/jan/13/us-library-r... [1] https://arstechnica.com/information-technology/2015/04/it-wasnt-easy-but-netflix-will-soon-use-https-to-secure-video-streams/ https://arstechnica.com/information-technology/2015/04/it-wa... [2] https://doesmysiteneedhttps.com/ https://doesmysiteneedhttps.com/ [3] https://whydoesaptnotusehttps.com/ https://whydoesaptnotusehttps.com/

doublerabbit 7y ago
I’ll agree to disagree, because otherwise the conversation would be moot. I just disagree that we should “HTTPS” everything and that’s partly because of the overhead. A medical site is different to a static html site like listed in the post. ISP regardless of SSL know which sites I’m visiting. It’s there in the HTTP host header regardless of SSL or not. And transit security can easily be encrypted without SSL but people are too lazy to encrypt their content within the application. “run acme encryptbot” no thanks. When I want a pure server with nothing other than my application I don’t want to download a certificate bot, install (lang) and let it mess with my configuration. I don’t dismiss that HTTPS is important but I feel platform is flawed. Owned by corporate greed. It’s security based upon pay us money or else model.
- MaxBarraclough 7y ago
  > the overhead The computational overhead is negligible. This simply isn't a credible argument against HTTPS. Netflix send petabytes of data over HTTPS. There's no excuse for anyone else. > A medical site is different to a static html site like listed in the post. Different in degree, but not in category. Your browsing habits on ordinary non-sensitive sites can still be used to profile you. > ISP regardless of SSL know which sites I’m visiting They can still look at the destination IP, yes, and they can probably look at your DNS requests, as secure DNS is currently only rarely used. It's still worth doing. Knowing that someone went on Wikipedia tells you almost nothing. Knowing the specific pages they went to, tells you a great deal. > It’s there in the HTTP host header regardless of SSL or not. That's not the case. HTTPS encrypts all headers. > transit security can easily be encrypted without SSL The easy solution is HTTPS. > people are too lazy to encrypt their content within the application. A universal principle in cyber-security: rolling your own crypto scheme is generally a terrible idea. As I said, Steam and Apt are the exceptions; they use plain HTTP for delivery, and implement secure file verification using hashes. Even here, with competent people running a simple delivery scheme, there can be serious security issues [0]. When it comes to web applications, you cannot implement your own secure delivery, for the obvious reason: an attacker can just replace your code. Sites like LastPass.com still have to use HTTPS to deliver the web app. Even if it could be done, there would be no reason to. The browser offers you HTTPS, so you get a carefully designed, battle-tested protocol, and a carefully designed, battle-tested implementation. You are entirely shielded from all the complexities. You aren't going to do better in JavaScript. > When I want a pure server with nothing other than my application I don’t want to download a certificate bot, install (lang) and let it mess with my configuration. It's additional configuration work, yes, but I don't accept that it's much of an argument against HTTPs. You still have totally free choice over your tooling and languages. > I don’t dismiss that HTTPS is important but I feel platform is flawed. You've not presented a single good argument against the technical merits of HTTPS. > Owned by corporate greed. It’s security based upon pay us money or else model. You can get certs for free. This isn't new. [1] [0] https://justi.cz/security/2019/01/22/apt-rce.html https://justi.cz/security/2019/01/22/apt-rce.html [1] https://en.wikipedia.org/wiki/Let%27s_Encrypt https://en.wikipedia.org/wiki/Let%27s_Encrypt
  - 7y ago

doublerabbit 7y ago

I’ll agree to disagree, because otherwise the conversation would be moot. I just disagree that we should “HTTPS” everything and that’s partly because of the overhead. A medical site is different to a static html site like listed in the post. ISP regardless of SSL know which sites I’m visiting. It’s there in the HTTP host header regardless of SSL or not. And transit security can easily be encrypted without SSL but people are too lazy to encrypt their content within the application. “run acme encryptbot” no thanks. When I want a pure server with nothing other than my application I don’t want to download a certificate bot, install (lang) and let it mess with my configuration. I don’t dismiss that HTTPS is important but I feel platform is flawed. Owned by corporate greed. It’s security based upon pay us money or else model.

MaxBarraclough 7y ago
> the overhead The computational overhead is negligible. This simply isn't a credible argument against HTTPS. Netflix send petabytes of data over HTTPS. There's no excuse for anyone else. > A medical site is different to a static html site like listed in the post. Different in degree, but not in category. Your browsing habits on ordinary non-sensitive sites can still be used to profile you. > ISP regardless of SSL know which sites I’m visiting They can still look at the destination IP, yes, and they can probably look at your DNS requests, as secure DNS is currently only rarely used. It's still worth doing. Knowing that someone went on Wikipedia tells you almost nothing. Knowing the specific pages they went to, tells you a great deal. > It’s there in the HTTP host header regardless of SSL or not. That's not the case. HTTPS encrypts all headers. > transit security can easily be encrypted without SSL The easy solution is HTTPS. > people are too lazy to encrypt their content within the application. A universal principle in cyber-security: rolling your own crypto scheme is generally a terrible idea. As I said, Steam and Apt are the exceptions; they use plain HTTP for delivery, and implement secure file verification using hashes. Even here, with competent people running a simple delivery scheme, there can be serious security issues [0]. When it comes to web applications, you cannot implement your own secure delivery, for the obvious reason: an attacker can just replace your code. Sites like LastPass.com still have to use HTTPS to deliver the web app. Even if it could be done, there would be no reason to. The browser offers you HTTPS, so you get a carefully designed, battle-tested protocol, and a carefully designed, battle-tested implementation. You are entirely shielded from all the complexities. You aren't going to do better in JavaScript. > When I want a pure server with nothing other than my application I don’t want to download a certificate bot, install (lang) and let it mess with my configuration. It's additional configuration work, yes, but I don't accept that it's much of an argument against HTTPs. You still have totally free choice over your tooling and languages. > I don’t dismiss that HTTPS is important but I feel platform is flawed. You've not presented a single good argument against the technical merits of HTTPS. > Owned by corporate greed. It’s security based upon pay us money or else model. You can get certs for free. This isn't new. [1] [0] https://justi.cz/security/2019/01/22/apt-rce.html https://justi.cz/security/2019/01/22/apt-rce.html [1] https://en.wikipedia.org/wiki/Let%27s_Encrypt https://en.wikipedia.org/wiki/Let%27s_Encrypt
- 7y ago