6 ms·

> Not gonna switch hosting nor pay 2x more for it just to please Google. Let's not pretend that HTTPS only exists to please Google. It has very real benefits f

> Not gonna switch hosting nor pay 2x more for it just to please Google. Let's not pretend that HTTPS only exists to please Google. It has very real benefits for your users.

Const-me 6y ago
My web site has no comments or other user-generated content, runs no CMS, uses no cookies, collects no data except standard web server logs, hosts no executables, and has no secret nor security sensitive content.
- wepple 6y ago
  At Starbucks I can inject arbitrary content into the browser of anyone who visits your site over HTTP and take control of their browser. Furthermore, congrats on your site but you’re 0.01% of sites like that. Should we keep an insecure web because your hosting provider is ripping you off? TLS is easy and free in 2021.
  - prepend 6y ago
    So what. We’ve all done this stuff and it’s fun for like 5 minutes. It’s been possible for decades and doesn’t end up being a common problem. And even if it was the risk is just crap injected into someone’s blog.
    - wepple 6y ago
      > It’s been possible for decades and doesn’t end up being a common problem. https://news.ycombinator.com/item?id=3804608 https://news.ycombinator.com/item?id=3804608 This is far more common than you think. ISPs, hotels, cafes, mobile providers do this en masse far more than you think. Have you forgotten the NSA “SSL added and removed here”? That was a highly targeted attack against infrastructure. What we’re discussing here is 10x easier to achieve. > And even if it was the risk is just crap injected into someone’s blog. That “crap injected” has full control over the DOM, any authentication, and everything displayed. How many of your users would happily put their creds into a fake login modal that popped up claiming to be SSO for a popular identity provider?
  - Const-me 6y ago
    I don't like when Google, or anyone at all really, tries to globally police the internets. It's up to web site owners to decide whether to implement encryption, and up to users to decide whether to use these web sites or not.
    - wepple 6y ago
      Website owners can decide: don’t use a cert. Users can decide: find a browser which doesn’t put importance on cert usage. You’ll find this hard to find because every browser manufacturer realizes that 99.9% of users cannot make sound security decisions, so they shouldn’t have to. Things should default to secure. There’s a trade off between protecting users and having a 100% free and open internet. An insecure internet is untrustworthy and therefore not useful, IMO.
  - echelon 6y ago
    > Furthermore, congrats on your site but you’re 0.01% of sites like that. Thanks to the rise of the almighty platforms we've lost the will and know-how to do it ourselves. > TLS is easy and free in 2021. Only if you're relying on complicated cloud infra or (non-free) managed providers that do everything for you. It's a lot of work to set this up on your own. It's impossible to be simple at this point. It's like the automotive industry which collectively decided to use computers for everything. You can't repair things yourself now. It's ironic, too, because now the industry finds itself with a chip shortage. I can imagine lots of scenarios where our complicated infrastructure requirements bite us. There should always be the option of not using TLS. It should be first-class and not require expertise to access or use.
    - nybble41 6y ago
      It's actually very easy to set up a TLS server using certificates from Let's Encrypt or any other ACME-compliant certificate provider. If you're using Apache, mod_md[0] will manage all the details for you. After enabling mod_md and mod_ssl, a simple TLS server only requires a few lines of extra configuration compared to a basic non-TLS site: MDCertificateAgreement accepted MDomain example.org <VirtualHost *:443> ServerName example.org ServerAdmin admin@example.org ServerAlias www.example.org # optional DocumentRoot htdocs/root SSLEngine on </VirtualHost> If you're using Nginx rather than Apache I believe it still requires an external script to handle certificate renewal, but the process remains fairly simple. The same scripts will also work with Apache if you don't want to use mod_md. [0] https://httpd.apache.org/docs/trunk/mod/mod_md.html https://httpd.apache.org/docs/trunk/mod/mod_md.html
- aj3 6y ago
  Without encryption active attacker could redirect users to different website, which would collect more data than your website does normally. They could also inject ads and javascript into users' sessions through your website.
  - Const-me 6y ago
    If an active attacker has sufficient motivation, hacking user's computer is way more profitable than messing with their home router in the middle.
    - rdedev 6y ago
      Redirecting an unencrypted webpage could be the first step a hacker uses to take over a user's computer. It's best to minimize attack vectors as much as possible
- shermheadryder 6y ago
  It doesn’t matter much what your web site has today. If it’s available over HTTP an attacker can inject whatever it wants into the page without too much trouble at all.

> Not gonna switch hosting nor pay 2x more for it just to please Google. Let's not pretend that HTTPS only exists to please Google. It has very real benefits for your users.

Const-me 6y ago

My web site has no comments or other user-generated content, runs no CMS, uses no cookies, collects no data except standard web server logs, hosts no executables, and has no secret nor security sensitive content.

wepple 6y ago
At Starbucks I can inject arbitrary content into the browser of anyone who visits your site over HTTP and take control of their browser. Furthermore, congrats on your site but you’re 0.01% of sites like that. Should we keep an insecure web because your hosting provider is ripping you off? TLS is easy and free in 2021.
- prepend 6y ago
  So what. We’ve all done this stuff and it’s fun for like 5 minutes. It’s been possible for decades and doesn’t end up being a common problem. And even if it was the risk is just crap injected into someone’s blog.
  - wepple 6y ago
    > It’s been possible for decades and doesn’t end up being a common problem. https://news.ycombinator.com/item?id=3804608 https://news.ycombinator.com/item?id=3804608 This is far more common than you think. ISPs, hotels, cafes, mobile providers do this en masse far more than you think. Have you forgotten the NSA “SSL added and removed here”? That was a highly targeted attack against infrastructure. What we’re discussing here is 10x easier to achieve. > And even if it was the risk is just crap injected into someone’s blog. That “crap injected” has full control over the DOM, any authentication, and everything displayed. How many of your users would happily put their creds into a fake login modal that popped up claiming to be SSO for a popular identity provider?
- Const-me 6y ago
  I don't like when Google, or anyone at all really, tries to globally police the internets. It's up to web site owners to decide whether to implement encryption, and up to users to decide whether to use these web sites or not.
  - wepple 6y ago
    Website owners can decide: don’t use a cert. Users can decide: find a browser which doesn’t put importance on cert usage. You’ll find this hard to find because every browser manufacturer realizes that 99.9% of users cannot make sound security decisions, so they shouldn’t have to. Things should default to secure. There’s a trade off between protecting users and having a 100% free and open internet. An insecure internet is untrustworthy and therefore not useful, IMO.
- echelon 6y ago
  > Furthermore, congrats on your site but you’re 0.01% of sites like that. Thanks to the rise of the almighty platforms we've lost the will and know-how to do it ourselves. > TLS is easy and free in 2021. Only if you're relying on complicated cloud infra or (non-free) managed providers that do everything for you. It's a lot of work to set this up on your own. It's impossible to be simple at this point. It's like the automotive industry which collectively decided to use computers for everything. You can't repair things yourself now. It's ironic, too, because now the industry finds itself with a chip shortage. I can imagine lots of scenarios where our complicated infrastructure requirements bite us. There should always be the option of not using TLS. It should be first-class and not require expertise to access or use.
  - nybble41 6y ago
    It's actually very easy to set up a TLS server using certificates from Let's Encrypt or any other ACME-compliant certificate provider. If you're using Apache, mod_md[0] will manage all the details for you. After enabling mod_md and mod_ssl, a simple TLS server only requires a few lines of extra configuration compared to a basic non-TLS site: MDCertificateAgreement accepted MDomain example.org <VirtualHost *:443> ServerName example.org ServerAdmin admin@example.org ServerAlias www.example.org # optional DocumentRoot htdocs/root SSLEngine on </VirtualHost> If you're using Nginx rather than Apache I believe it still requires an external script to handle certificate renewal, but the process remains fairly simple. The same scripts will also work with Apache if you don't want to use mod_md. [0] https://httpd.apache.org/docs/trunk/mod/mod_md.html https://httpd.apache.org/docs/trunk/mod/mod_md.html
aj3 6y ago
Without encryption active attacker could redirect users to different website, which would collect more data than your website does normally. They could also inject ads and javascript into users' sessions through your website.
- Const-me 6y ago
  If an active attacker has sufficient motivation, hacking user's computer is way more profitable than messing with their home router in the middle.
  - rdedev 6y ago
    Redirecting an unencrypted webpage could be the first step a hacker uses to take over a user's computer. It's best to minimize attack vectors as much as possible
shermheadryder 6y ago
It doesn’t matter much what your web site has today. If it’s available over HTTP an attacker can inject whatever it wants into the page without too much trouble at all.