3 ms·
I was disappointed the article is so thin on real substance. It could have listed out the reasons to always use HTTPS. Easily done: 1. Privacy matters. A medic
by MaxBarraclough 7y ago
I was disappointed the article is so thin on real substance. It could have listed out the reasons to always use HTTPS. Easily done:
1. Privacy matters. A medical website, or indeed Wikipedia, should prevent a snooping ISP from finding out you have been reading about an embarrassing condition. This is similar to the way librarians are extremely protective of their loan records [0]. Netflix use HTTPS for their streams, for the same reason (it does nothing to aid their DRM, it's purely about privacy) [1].
2. HTTPS prevents ads/trackers/malware being injected into the page by unscrupulous ISPs (this really has happened [2])
3. Modern browsers will (rightly) warn users not to trust the site. This makes the site look bad.
4. Some fancy browser features are disabled if you use unencrypted HTTP. Likely irrelevant for a static site though.
5. Let's turn the tables and ask why you wouldn't use HTTPS for a public-facing web server. There are just 3 reasons:
* Reduced admin overhead not having to bother with certs
* It enables caching web proxies, which is only relevant if you're running a serious distribution platform like Steam, or a Linux package-management repo [3]
* Better support for very old devices, such as old smartphones in the developing world
[0] https://www.theguardian.com/us-news/2016/jan/13/us-library-r.. https://www.theguardian.com/us-news/2016/jan/13/us-library-r....
[1] https://arstechnica.com/information-technology/2015/04/it-wa.. https://arstechnica.com/information-technology/2015/04/it-wa....
[2] https://doesmysiteneedhttps.com/ https://doesmysiteneedhttps.com/
[3] https://whydoesaptnotusehttps.com/ https://whydoesaptnotusehttps.com/
(Taken from an old comment of mine at https://news.ycombinator.com/item?id=21912817 https://news.ycombinator.com/item?id=21912817 )
Edit: Added the third reason not to use HTTPS
- 0xff00ffee 7y agoGreat thread about #1 here: https://stackoverflow.com/questions/499591/are-https-urls-encrypted https://stackoverflow.com/questions/499591/are-https-urls-en...
- MaxBarraclough 7y agoJust don't forget about 'SNI', https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication
- derf_ 7y agoThere is an extension to TLS 1.3 that supports encrypted SNI, and it has been deployed on some popular services since 2018. Of course, your DNS is likely still unencrypted. But maybe one day we'll get there.
- Jenda_ 7y agoad. 5 - There are more. For example: * You don't like the Let’s Encrypt Subscriber Agreement, for example the part about indemnification and attorneys' fees. * Your domain name is on Let's Encrypt blacklist (https://community.letsencrypt.org/t/name-is-blacklisted-on-renew/9012/6 https://community.letsencrypt.org/t/name-is-blacklisted-on-r..., https://community.letsencrypt.org/t/domain-blacklist/106374 https://community.letsencrypt.org/t/domain-blacklist/106374), though they now seem to un-blacklist most cases on email request. I think the problem is that there are little alternatives to LE.
- MaxBarraclough 7y agoI'm not sold on either of these objections. Let's Encrypt is not the only CA. If you don't like the free CA, pay to use another one. If I see unencrypted HTTP on a website, I immediately think less of that website. It's a Good Thing that the web has got to this point. Quibbles about Let's Encrypt's terms don't strike me as convincing. > I think the problem is that there are little alternatives to LE. But there are. Again, there's a whole marketplace of CAs to choose from. If anything, there are too many CAs trusted by today's browsers.
- labawi 7y ago> * It enables caching web proxies, which is only relevant It is also relevant if you're in an African village, or any other place that has bad/slow internet and children in school can't visit typical websites because they want a fancy separate connection with each of their devices.