3 ms·

I have Firefox’s “HTTPS-only” mode enabled. teavm.org is only served on HTTP. This gave me a rather bad first impression of a thing for making modern web apps—T

I have Firefox’s “HTTPS-only” mode enabled. teavm.org is only served on HTTP. This gave me a rather bad first impression of a thing for making modern web apps—TLS is table stakes that you should never be without. (I tend to find something HTTP-only about once a day, normally on sites that have been around for over ten years. Normally I’d just shrug if it’s a content site, but this being for making web apps, I figured it was worth commenting on.)

josho 6y ago
Tell me again what the threat mode TLS protects against for a marketing site? The only thing I can think of is my ISP injecting some HTML at the top of the page. Something that I haven’t seen for years.
- nayuki 6y ago
  Letting the ISP inject stuff is the threat model, and it has happened in real life. https://www.theregister.com/2015/03/27/github_under_fire_from_weaponized_great_firewall/ https://www.theregister.com/2015/03/27/github_under_fire_fro... Every connection that happens over unsecured HTTP is a connection that can be hijacked by middlemen for nefarious purposes, both for spying and for attacking. Encrypting as many connections as possible is a form of herd immunity. Encrypting even unimportant "marketing" websites protects everyone on the web by raising the cost of interception and lowering the benefits.
  - jtheory 6y ago
    100% yes. It's also about the entire internet & its users, not just threat models on specific sites. We can't ask the general public to consider threat models and evaluate what sites should need HTTPS or just HTTP. General, non-technical intuition is basically useless for this eval; it's not a good path. It's much smarter to just make HTTPS the default, make it easy & free for any site to provide it, and then let browsers show big warnings for any site that's not secured. (Browsers are moving this way already)
- ev1 6y ago
  My ISP injects HTML and scripting onto the page (US). In many countries MITMing your page and replacing its contents, or using it to serve malware to targets is a frequent case.
  - josho 6y ago
    I had no idea that was still practiced. Thank you for sharing. What is the ISP injecting into page?

josho 6y ago

Tell me again what the threat mode TLS protects against for a marketing site? The only thing I can think of is my ISP injecting some HTML at the top of the page. Something that I haven’t seen for years.

nayuki 6y ago
Letting the ISP inject stuff is the threat model, and it has happened in real life. https://www.theregister.com/2015/03/27/github_under_fire_from_weaponized_great_firewall/ https://www.theregister.com/2015/03/27/github_under_fire_fro... Every connection that happens over unsecured HTTP is a connection that can be hijacked by middlemen for nefarious purposes, both for spying and for attacking. Encrypting as many connections as possible is a form of herd immunity. Encrypting even unimportant "marketing" websites protects everyone on the web by raising the cost of interception and lowering the benefits.
- jtheory 6y ago
  100% yes. It's also about the entire internet & its users, not just threat models on specific sites. We can't ask the general public to consider threat models and evaluate what sites should need HTTPS or just HTTP. General, non-technical intuition is basically useless for this eval; it's not a good path. It's much smarter to just make HTTPS the default, make it easy & free for any site to provide it, and then let browsers show big warnings for any site that's not secured. (Browsers are moving this way already)
ev1 6y ago
My ISP injects HTML and scripting onto the page (US). In many countries MITMing your page and replacing its contents, or using it to serve malware to targets is a frequent case.
- josho 6y ago
  I had no idea that was still practiced. Thank you for sharing. What is the ISP injecting into page?