6 ms·
Sites which don't handle user data do not need HTTPS.
by cutler 3y ago
Sites which don't handle user data do not need HTTPS.
- naikrovek 3y agothey do if they don't want a user's ISP to inject ads or modify content in transit. this does happen
- bmacho 3y agoJust make it illegal (I think it already is on most of the world), problem solved.
- naikrovek 3y agoyou're right. making an activity illegal always stops it.
- bmacho 3y agoI don't remember saying that, or anything close to it? If the law forbids ISPs to show ads or modify the content in any way, then they won't do it.
- pixl97 3y agoNo what you stated was "take money out of politics" which is going to be far more difficult then the technical issues we're presented with. Why that statement, because any law to ban ISPs from doing this will be met with millions in political investment by said ISPs to prevent it. Since the average person doesn't care about this issue it's a losing proposition.
- davewiner 3y agoi'm not going to re-do all the sites i did in the 90s, 00s, 10s. never going to happen.
- naikrovek 3y agoI'm not asking you to
- nlewycky 3y agoCould you elaborate? I thought upgrading to HTTPS wouldn't involve redoing any sites, no changes to the HTML/CSS/JS/server side code, except for the TLS configuration and maybe replacing links from "http:" to "https:" but that's optional. I'd like to hear how it requires redoing a website?
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- amf12 3y agoIt's not just for sites which handle user data. MITM attacks are real. Non-tech people don't know what VPN, HTTP or HTTPS are. Here's an example: a person goes to say Reddit, and clicks on a HTTP link about a new recipe. It's possible for a link to a malicious site being injected in the page. These were pretty common in developing countries.
- nlewycky 3y agoNonsense, all sites need HTTPS. Any HTTP connection can have its contents rewritten by an middle party, so if you are using HTTP and not HTTPS then you are 100% OK with the recipient getting altered or incorrect data. If that's the case, just delete your content and serve a 404 instead since you've already stated you're OK with this. Why do you think "handling user data" is the only reason to employ encryption? What if the website is serving up static content that seems completely fine to you or I but the user is in a legal situation where they would be in trouble for reading it? What if the user is somebody the local police are trying to frame, so the request was normal, the response was normal, but the response was replaced with something illegal so the police can arrest for possession? Why should every router on the path be able to see what I'm reading, what I'm reading web pages about medical conditions? Why do you insist that everyone should collectively make technical decisions that serve to enable this kind of thing? This isn't hypothetical. A country once used their position of owning the local telecom to inject javascript into web pages that would DDoS another website they didn't like. See https://en.wikipedia.org/wiki/Great_Cannon https://en.wikipedia.org/wiki/Great_Cannon . The web moved from HTTP-over-TCP to HTTP-over-TLS because it fixes real problems. One of the common mistakes people make when thinking about security is trying to imagine the attacks themselves and then only defending against those. Your imagination is not the limit, you're up against the collective creativity of everyone else. Encrypt your stuff and remove a whole category of possible problems.
- jackweirdy 3y agoDo LAN sites need HTTPS? IE wifi router, printer, fax control panel? I am pro-HTTP for these use cases for as long as browsers have more serious warnings against self signed certs, old SSL/TLS versions and weak algo choices than the warnings for HTTP. Hardware deserves to be supported as long as it physically works rather than as long as its embedded TLS stays supported