3 ms·
Security is about the ”CIA triad“, i.e. confidentiality, integrity, and availability. For those sites you mention, confidentiality and availability will not re
by cpach 5y ago
Security is about the ”CIA triad“, i.e. confidentiality, integrity, and availability.
For those sites you mention, confidentiality and availability will not really be impacted by HTTPS.
But the integrity can be.
Case in point: See this comment https://news.ycombinator.com/item?id=27507826 https://news.ycombinator.com/item?id=27507826
- t0mbstone 5y agoHTTPS is definitely useful for preserving the integrity of data between the server and the end user. To be clear, I'm very pro-SSL and have used LetsEncrypt for years on all my domains. I was just taking issue with the notion that someone's web server serving static content could be breached just because it didn't have an SSL cert.
- Spivak 5y agoI mean define breached? I don't think anyone ever would say that without TLS you can use HTTP to drop into a shell on the server. But you can, largely arbitrarily, mess with the content of the site if you're adjacent to either the sever or client, or in the path between them. Maybe this matters a lot for someone's security, maybe it doesn't at all.