5 ms·
> grep http: current.csv | wc -l 54679 So over 5% of the top 1m sites still don't use HTTPS.
by anonu 4y ago
> grep http: current.csv | wc -l
54679
So over 5% of the top 1m sites still don't use HTTPS.
- Proven 4y ago[dead]
- philipphutterer 4y agoHow about websites that are browsed http first and then redirected? People might browse for a domain without the https prefix for convenience (or old links) and the browser defaults to http.
- alfu 4y agoIf I am not mistaken, 8310 sites offer http and https: grep -o -E "://.*?," current.csv | sort | uniq -c | grep -v "1 ://" | wc -l 8310
- forgotmypw17 4y ago[flagged]
- bedatadriven 4y agoWhat accessibility challenges does https pose?
- forgotmypw17 4y agoThe accessibility challenges are all the extra different failure modes HTTPS presents, such as client date offset, older devices, expired certificates, hostname mismatches, and many others. Security is not the only priority in existence. Sometimes people just want to access the information. And when that is the case, HTTPS can be a huge impediment.
- 2Gkashmiri 4y agoyeah... i havent gotten a good response why localhost should scream "insecure" or why i should wikipedia fail if my rtc clock is wonky. i am not denying "security from snoops while paying with credit cards" and all that banking shit or messaging. heck, email is sent over the clear but we are told to use https to connect to the website (for webmails) using https for "security"... sure sure security is all good and snazzy but i regularly come across websites who have had certs expired and the website makes it appear as if the sky will fall if i click on continue. then we have ISPs who use DPI (my current ISP, reliance jio is doing it from day 1) so whats the point of pretending anyway?
- rileymat2 4y ago> email is sent over the clear but we are told to use https to connect to the website (for webmails) using https for "security" This is not true, most is encrypted in transit. It is not end to end, because your email service stores them (perhaps encrypted perhaps not). Edit: https://transparencyreport.google.com/safer-email/overview?hl=en&encrypt_out=start:1656633600000;end:1666137599999;series:outbound&lu=encrypt_out https://transparencyreport.google.com/safer-email/overview?h... You can see 84% of outbound is encrypted. This probably is generally a good proxy for the state of email tls transport.
- jefftk 4y ago> why localhost should scream "insecure" Localhost, even with HTTP, is a secure context: https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts https://developer.mozilla.org/en-US/docs/Web/Security/Secure... What tool is screaming at you that localhost is insecure?
- 2Gkashmiri 4y agobrowsers. padlock icon is crossed out
- jefftk 4y agoI just tested this and don't see that. I compared http://neverssl.com http://neverssl.com to running "python3 -m http.server" and visiting http://localhost:8000 http://localhost:8000 * Chrome: "Not Secure" on neverssl, "i" in a circle on localhost * Firefox: Padlock with a red line through it on neverssl, page icon on localhost * Safari: "Not Secure" on neverssl, no message on localhost
- zX41ZdbW 4y agoI have prepared a nice report: the rank of the websites in groups 1..10, 11..100, ... the percentage of TLS and an example of non-TLS website: https://play.clickhouse.com/play?user=play#U0VMRUNUIGZsb29yKGxvZzEwKHJhbmspKSBBUyByLCBjb3VudCgpIEFTIHRvdGFsLCBzdW0obG9nIExJS0UgJyVUTFMlJykgQVMgdGxzLCByb3VuZCh0bHMgLyB0b3RhbCwgMikgQVMgcmF0aW8sIGFueUlmKGRvbWFpbiwgbG9nIE5PVCBMSUtFICclVExTJScpIEZST00gbWluaWNyYXdsIFdIRVJFIGxvZyBMSUtFICclQ29udGVudC1MZW5ndGg6JScgR1JPVVAgQlkgciBPUkRFUiBCWSBy https://play.clickhouse.com/play?user=play#U0VMRUNUIGZsb29yK... SELECT floor(log10(rank)) AS r, count() AS total, sum(log LIKE '%TLS%') AS tls, round(tls / total, 2) AS ratio, anyIf(domain, log NOT LIKE '%TLS%') FROM minicrawl WHERE log LIKE '%Content-Length:%' GROUP BY r ORDER BY r ┌─r─┬───total─┬─────tls─┬─ratio─┬─anyIf(domain, notLike(log, '%TLS%'))─┐ │ 0 │ 6 │ 6 │ 1 │ │ │ 1 │ 61 │ 58 │ 0.95 │ baidu.com │ │ 2 │ 599 │ 562 │ 0.94 │ google.cn │ │ 3 │ 5591 │ 5057 │ 0.9 │ volganet.ru │ │ 4 │ 51279 │ 44291 │ 0.86 │ furbo.co │ │ 5 │ 476181 │ 361910 │ 0.76 │ funygold.com │ │ 6 │ 3797023 │ 2927052 │ 0.77 │ funyo.vip │ └───┴─────────┴─────────┴───────┴──────────────────────────────────────┘ 7 rows in set. Elapsed: 0.844 sec. Processed 7.59 million rows, 43.74 GB (8.99 million rows/s., 51.83 GB/s.)
- _nhynes 4y ago“The 5% rule”