3 ms·

Agree, what I dislike most about https is the way it effectively has a forced expiry date. Have you ever stumbled across someones old abandoned university proje

by somat 4y ago

Agree, what I dislike most about https is the way it effectively has a forced expiry date. Have you ever stumbled across someones old abandoned university project page, a blast from the past with all sorts of interesting information. hopes and dreams from a bygone era. not gonna happen with https.

Dylan16807 4y ago
Those pages are abandoned, but the servers aren't abandoned. The same person keeping it running should be able to update certs just fine.
- readthenotes1 4y ago
  Keeping your certs up to date is a little bit harder than turning it on and off again every now and then
  - dugite-code 4y ago
    Not if you are using tools like letsencrypt, something most blogs and small university projects would readily use. Yes there may be a breaking change in the future but it's quite set and forget at this point.
    - account42 4y ago
      Seeing as there are severs that are still running but have expired (letsencrypt) certificates, yes it is unquestionably harder.
      - Dylan16807 4y ago
        That's not how that works! If servers have an 80% survival chance, and a 95% certificate renewal chance, you'll only see the servers that are running with expired certs. You won't see the inverse.
gabcoh 4y ago
The https certificate “expiration” date is basically just a “fallback to treating this website as http” date. The site is still perfectly accessible and arguably still more secure than an http only site, you just have to click the scary button saying you know what you’re doing and proceed to the website treating it as though it was compromised which isn’t a big deal for the static pages you’re describing.
- account42 4y ago
  Besides the certifacte expiration date there are also expiration dates in the protocol itself as newer clients/servers will refuse to use older SSL/TLS versions or ciphers. But even with "just" certificate expiration the user experience is not even close to "fall back to HTTP". Browsers won't even give you the choice to override certificate check at all with HSTS. Then there is the fact that the move from HTTP to HTTPS changes all URLs. If only we would have had StartTLS for HTTP - and no, there is no security issue with StartTLS as you will need something like HSTS preloading anyway if you actually want to guarantee security. Lack of backwards compatibility is absolutely a concern that the security community seems to care little about.

by somat 4y ago

Dylan16807 4y ago

Those pages are abandoned, but the servers aren't abandoned. The same person keeping it running should be able to update certs just fine.

readthenotes1 4y ago
Keeping your certs up to date is a little bit harder than turning it on and off again every now and then
- dugite-code 4y ago
  Not if you are using tools like letsencrypt, something most blogs and small university projects would readily use. Yes there may be a breaking change in the future but it's quite set and forget at this point.
  - account42 4y ago
    Seeing as there are severs that are still running but have expired (letsencrypt) certificates, yes it is unquestionably harder.
    - Dylan16807 4y ago
      That's not how that works! If servers have an 80% survival chance, and a 95% certificate renewal chance, you'll only see the servers that are running with expired certs. You won't see the inverse.

gabcoh 4y ago

The https certificate “expiration” date is basically just a “fallback to treating this website as http” date. The site is still perfectly accessible and arguably still more secure than an http only site, you just have to click the scary button saying you know what you’re doing and proceed to the website treating it as though it was compromised which isn’t a big deal for the static pages you’re describing.

account42 4y ago
Besides the certifacte expiration date there are also expiration dates in the protocol itself as newer clients/servers will refuse to use older SSL/TLS versions or ciphers. But even with "just" certificate expiration the user experience is not even close to "fall back to HTTP". Browsers won't even give you the choice to override certificate check at all with HSTS. Then there is the fact that the move from HTTP to HTTPS changes all URLs. If only we would have had StartTLS for HTTP - and no, there is no security issue with StartTLS as you will need something like HSTS preloading anyway if you actually want to guarantee security. Lack of backwards compatibility is absolutely a concern that the security community seems to care little about.