3 ms·

Because no sensitive content is being transferred. Why put the extra hassle of getting and installing a non-self-signed certificate for a blog where the user do

Because no sensitive content is being transferred. Why put the extra hassle of getting and installing a non-self-signed certificate for a blog where the user doesn't even submit data? There's no reason for that connection to be secure.

scrollaway 12y ago
> Because no sensitive content is being transferred. You're answering "why" instead of answering "why not" again. "Why should you lock your door if you don't have anything expensive?" Plaintext HTTP should not exist, then we wouldn't be having this discussion. I wouldn't have to come up with elaborate scenarios where having HTTPS from the get go would have saved lives, and you wouldn't have to come up with crazy "but that'll never happen" retort to them. Unfortunately, plaintext HTTP exists, so here we are, with me telling you that the pro-gay rights piece you wrote on your static blog contains keywords that make it be viewed as extremism/terrorism by Russia's automated monitoring systems and anyone reading it gets immediately added to a watchlist. Unfortunately, a few of your readers are from russia and six months later those readers join a political protest against the killing of kittens or something. Their government notices that and makes sure to "take action". And to think HTTPS could have avoided that.
- Yver 12y ago
  > "Why should you lock your door if you don't have anything expensive?" Locks come standard on every door, they don't expire after a given time and every child knows how to use them. See how your comparison to acquiring, setting up and maintainning an SSL certificate is nonsensical? > And to think HTTPS could have avoided that. If the NSA tags people who look for info on TOR as extremists, an hypothetical state might tag people who use HTTPS. And to think that HTTP could have avoided that! I mean, if every argument is an hypothetical, anything is possible.
  - scrollaway 12y ago
    If HTTPS is used globally, people can't be flagged for using it (or the flags end up being useless). Right now, you are correct, people could hypothetically be flagged for using HTTPS. This would not happen if every static blog and what not out there would use it. Thank you for reinforcing my point, I appreciate the help.
M2Ys4U 12y ago
>Because no sensitive content is being transferred. Define "sensitive". If there is a network attack[0] then the metadata of who is viewing which pages on your blog is revealed. With TLS, only the client/server address pair is leaked. [0] http://tools.ietf.org/html/rfc7258 http://tools.ietf.org/html/rfc7258
- X-Istence 12y ago
  And the hostname of the server you are connecting to... if SNI is used because we don't have enough IPv4 addresses to host every single site on a unique IP. IPv6 will bring back enough IP's to allow each site to be it's own IP, and no longer require SNI...
  - timmclean 12y ago
    And then, of course, we'll effectively be back to leaking hostnames, since there will be a 1:1 mapping between IPs and hostnames...
MichaelGG 12y ago
It leaks data on what articles the user is reading. It also leaks data on their browser configuration. On top of that, an attacker could modify the content delivered from the blog to influence user actions. Either technically (like put a link to a child porn site to get the target's computer to make such a request and cache it), or socially (like changing the message of the blog to provide a bad recipe for a cake, or misleading info on a political candidate).

scrollaway 12y ago

> Because no sensitive content is being transferred. You're answering "why" instead of answering "why not" again. "Why should you lock your door if you don't have anything expensive?" Plaintext HTTP should not exist, then we wouldn't be having this discussion. I wouldn't have to come up with elaborate scenarios where having HTTPS from the get go would have saved lives, and you wouldn't have to come up with crazy "but that'll never happen" retort to them. Unfortunately, plaintext HTTP exists, so here we are, with me telling you that the pro-gay rights piece you wrote on your static blog contains keywords that make it be viewed as extremism/terrorism by Russia's automated monitoring systems and anyone reading it gets immediately added to a watchlist. Unfortunately, a few of your readers are from russia and six months later those readers join a political protest against the killing of kittens or something. Their government notices that and makes sure to "take action". And to think HTTPS could have avoided that.

Yver 12y ago
> "Why should you lock your door if you don't have anything expensive?" Locks come standard on every door, they don't expire after a given time and every child knows how to use them. See how your comparison to acquiring, setting up and maintainning an SSL certificate is nonsensical? > And to think HTTPS could have avoided that. If the NSA tags people who look for info on TOR as extremists, an hypothetical state might tag people who use HTTPS. And to think that HTTP could have avoided that! I mean, if every argument is an hypothetical, anything is possible.
- scrollaway 12y ago
  If HTTPS is used globally, people can't be flagged for using it (or the flags end up being useless). Right now, you are correct, people could hypothetically be flagged for using HTTPS. This would not happen if every static blog and what not out there would use it. Thank you for reinforcing my point, I appreciate the help.

M2Ys4U 12y ago

>Because no sensitive content is being transferred. Define "sensitive". If there is a network attack[0] then the metadata of who is viewing which pages on your blog is revealed. With TLS, only the client/server address pair is leaked. [0] http://tools.ietf.org/html/rfc7258 http://tools.ietf.org/html/rfc7258

X-Istence 12y ago
And the hostname of the server you are connecting to... if SNI is used because we don't have enough IPv4 addresses to host every single site on a unique IP. IPv6 will bring back enough IP's to allow each site to be it's own IP, and no longer require SNI...
- timmclean 12y ago
  And then, of course, we'll effectively be back to leaking hostnames, since there will be a 1:1 mapping between IPs and hostnames...

MichaelGG 12y ago

It leaks data on what articles the user is reading. It also leaks data on their browser configuration. On top of that, an attacker could modify the content delivered from the blog to influence user actions. Either technically (like put a link to a child porn site to get the target's computer to make such a request and cache it), or socially (like changing the message of the blog to provide a bad recipe for a cake, or misleading info on a political candidate).