3 ms·

I'm not sure I agree with this. I don't see a point in HTTPS for 100% static sites.

by Oculus 12y ago

ayrx 12y ago
Static sites can have their content modified silently in a MITM attack as well.
etherealG 12y ago
That 100% static site can be monitored. Which pages you visit on it and what that says about you. Privacy is always valuable.
- joesavage 12y ago
  I'm not sure about "always". I run a site that provides counter information for League of Legends (http://www.championcounter.com/ http://www.championcounter.com/) and I doubt very much my users will benefit at all from me moving over to HTTPS.
  - spacefight 12y ago
    Sure they would benefit. They could check whatever is on your site without anyone in between noticing (WLAN e.g. at starbucks, corporate LANs and the proxies used etc etc). There are companies out there, who buy surf-habits (read: browsing logs of URLs visited) and mine it for valuable data. Encrypt.
  - asperous 12y ago
    A lot of work routers might flag that site url as "GAMING" and with too much use could potentially contribute to someone losing their job. Also some isps have been caught injecting ads into plain text web sites [1]. Do you want more ads on your site that you didn't put there? [1] http://zmhenkel.blogspot.com/2013/03/isp-advertisement-injection-cma.html http://zmhenkel.blogspot.com/2013/03/isp-advertisement-injec...
    - joesavage 12y ago
      Switching over to HTTPS in and of itself shouldn't stop much data leakage given that the hostname - at least at current - isn't difficult to obtain (and really gives the game away for the content you're visiting as far as my site is concerned), but I suppose it's a step in the right direction and will stop primitive tracking attempts. Protecting against code injection is actually a fair point though.
dsl 12y ago
The NSA and other state actors can use non-secure pages to inject code to exploit the browser and compromise your visitors. http://en.wikipedia.org/wiki/FOXACID#QUANTUM_attacks http://en.wikipedia.org/wiki/FOXACID#QUANTUM_attacks
- icebraining 12y ago
  State actors are probably irrelevant in this discussion; few of them won't be able to get a certificate to any website they want, in my opinion.
  - dsl 12y ago
    This is a known issue and being addressed as well. http://tools.ietf.org/html/draft-ietf-websec-key-pinning-11 http://tools.ietf.org/html/draft-ietf-websec-key-pinning-11 http://dev.chromium.org/sts http://dev.chromium.org/sts
rakoo 12y ago
You're seeing HTTPS as a move from HTTP with a burden. Let's see it the other way: any sane webserver allows you to easily activate TLS, and generating a certificate is both free and easy. What's the point of going back to HTTP at this point ?

I'm not sure I agree with this. I don't see a point in HTTPS for 100% static sites.

by Oculus 12y ago

I'm not sure I agree with this. I don't see a point in HTTPS for 100% static sites.

ayrx 12y ago

Static sites can have their content modified silently in a MITM attack as well.

etherealG 12y ago

That 100% static site can be monitored. Which pages you visit on it and what that says about you. Privacy is always valuable.

joesavage 12y ago
I'm not sure about "always". I run a site that provides counter information for League of Legends (http://www.championcounter.com/ http://www.championcounter.com/) and I doubt very much my users will benefit at all from me moving over to HTTPS.
- spacefight 12y ago
  Sure they would benefit. They could check whatever is on your site without anyone in between noticing (WLAN e.g. at starbucks, corporate LANs and the proxies used etc etc). There are companies out there, who buy surf-habits (read: browsing logs of URLs visited) and mine it for valuable data. Encrypt.
- asperous 12y ago
  A lot of work routers might flag that site url as "GAMING" and with too much use could potentially contribute to someone losing their job. Also some isps have been caught injecting ads into plain text web sites [1]. Do you want more ads on your site that you didn't put there? [1] http://zmhenkel.blogspot.com/2013/03/isp-advertisement-injection-cma.html http://zmhenkel.blogspot.com/2013/03/isp-advertisement-injec...
  - joesavage 12y ago
    Switching over to HTTPS in and of itself shouldn't stop much data leakage given that the hostname - at least at current - isn't difficult to obtain (and really gives the game away for the content you're visiting as far as my site is concerned), but I suppose it's a step in the right direction and will stop primitive tracking attempts. Protecting against code injection is actually a fair point though.

dsl 12y ago

The NSA and other state actors can use non-secure pages to inject code to exploit the browser and compromise your visitors. http://en.wikipedia.org/wiki/FOXACID#QUANTUM_attacks http://en.wikipedia.org/wiki/FOXACID#QUANTUM_attacks

icebraining 12y ago
State actors are probably irrelevant in this discussion; few of them won't be able to get a certificate to any website they want, in my opinion.
- dsl 12y ago
  This is a known issue and being addressed as well. http://tools.ietf.org/html/draft-ietf-websec-key-pinning-11 http://tools.ietf.org/html/draft-ietf-websec-key-pinning-11 http://dev.chromium.org/sts http://dev.chromium.org/sts

rakoo 12y ago

You're seeing HTTPS as a move from HTTP with a burden. Let's see it the other way: any sane webserver allows you to easily activate TLS, and generating a certificate is both free and easy. What's the point of going back to HTTP at this point ?