3 ms·

I fully agree with the theoretical threat vector. But is it an actual, practical, meaningful threat vector or an issue for the type of website I describe (empa

I fully agree with the theoretical threat vector. But is it an actual, practical, meaningful threat vector or an issue for the type of website I describe (empathically, NOT top 20 site, like Wikipedia is:)? Everything in IT and IT Security is or should be an evaluation, a compromise of specific graphs of price and effort and impact and risk. My question is not "Should Wikipedia have HTTPS", but "Does every single one of remaining 15% of websites need to be encrypted", and that's not a persuasive argument.

yakireev 5y ago
> But is it an actual, practical, meaningful threat vector or an issue Back when http was common and 3G was still kinda expensive, many public WiFi networks would MITM all the web pages you request to inject their own ads into them. A notable example I remember vividly - the public WiFi network of Moscow Metro used to do this for non-paying customers, and it was particularly bad because 3G/4G did not work well underground back then. This alone was a good motivation to switch my plain-html ad-free websites to https as soon as Let's Encrypt became a thing.