5 ms·

Let's Encrypt started in 2014 to address HTTP overuse. In 2011, I (in-house corp app dev) was still stuck with HTTP services (behind a firewall, accessible onl

by tl 5y ago

Let's Encrypt started in 2014 to address HTTP overuse. In 2011, I (in-house corp app dev) was still stuck with HTTP services (behind a firewall, accessible only via VPN). In 2014, public facing mobile apps using HTTP was prevalent enough to prompt name and shame campaigns. [1] My fuzzy memory suggests some banks were still using HTTP. [1] https://arstechnica.com/information-technology/2014/08/new-website-aims-to-shame-apps-with-lax-security/ https://arstechnica.com/information-technology/2014/08/new-w...

shkkmo 5y ago
I started doing professional web development in 2011. It was very clear at the time that not using HTTPS for any site with a login was an BAD practice that made your users less secure. There were clearly people and institution still using bad practices, but risks were clear to most web developers. What was shifting at the time was developer views on using HTTPS for non-secure, unauthenticated portions of websites. This is where the "HTTPS Everywhere" plugin and other such movements came in.
- pooper 5y ago
  From what I remember there was a lot of pushback from infrastructure as we thought using https for the whole website would increase CPU load. Never verified if this was true... but I'm sure someone here should know.
  - shkkmo 5y ago
    Re 2011 Push back on what? There was pushback against HTTPS for non-authenticated pages for various reasons. That does not mean that HTTPS for authenticated pages was not considered a standard and necessary security measure.
benlivengood 5y ago
Bank of America back in 2005 (timestamp from the annoyed email I sent them) refused to load the front page over https. I think it even redirected https attempts back to http. The form submission was over https. The solution was to enter garbage for the first login since the "re-enter your password" page was served over https. I think they fixed it before 2011, but don't have an exact record of when.
birdyrooster 5y ago
Let’s encrypt came way way late to the party. We had been banging the drum for 20 years by then.
kaszanka 5y ago
If the pages are only accessible via a VPN, what does HTTPS really get you?
- tl 5y ago
  Not needing a VPN. rimshot In all seriousness, better security. You are leaking whatever payload is sent right after VPN drops. An early version of the application had a defect because it did not check response payloads on an endpoint (the code handled errors, but 200 OK was all it needed on success). This is not what you want when the 200 OK is followed by the HTML of a hotel's wi-fi access page.

by tl 5y ago

shkkmo 5y ago

I started doing professional web development in 2011. It was very clear at the time that not using HTTPS for any site with a login was an BAD practice that made your users less secure. There were clearly people and institution still using bad practices, but risks were clear to most web developers. What was shifting at the time was developer views on using HTTPS for non-secure, unauthenticated portions of websites. This is where the "HTTPS Everywhere" plugin and other such movements came in.

pooper 5y ago
From what I remember there was a lot of pushback from infrastructure as we thought using https for the whole website would increase CPU load. Never verified if this was true... but I'm sure someone here should know.
- shkkmo 5y ago
  Re 2011 Push back on what? There was pushback against HTTPS for non-authenticated pages for various reasons. That does not mean that HTTPS for authenticated pages was not considered a standard and necessary security measure.

benlivengood 5y ago

Bank of America back in 2005 (timestamp from the annoyed email I sent them) refused to load the front page over https. I think it even redirected https attempts back to http. The form submission was over https. The solution was to enter garbage for the first login since the "re-enter your password" page was served over https. I think they fixed it before 2011, but don't have an exact record of when.

birdyrooster 5y ago

Let’s encrypt came way way late to the party. We had been banging the drum for 20 years by then.

kaszanka 5y ago

If the pages are only accessible via a VPN, what does HTTPS really get you?

tl 5y ago
Not needing a VPN. rimshot In all seriousness, better security. You are leaking whatever payload is sent right after VPN drops. An early version of the application had a defect because it did not check response payloads on an endpoint (the code handled errors, but 200 OK was all it needed on success). This is not what you want when the 200 OK is followed by the HTML of a hotel's wi-fi access page.