4 ms·

My website only contains publically available stuff for people to read. Is there any reason why I would want to use https for this use case? Or what does "ent

My website only contains publically available stuff for people to read. Is there any reason why I would want to use https for this use case? Or what does "entire web" mean?

aw3c2 12y ago
Yes, because it is no one's business what people are looking at anyways. If you have more than one URL, HTTPS will hide that. HTTPS will also make an attacker unable to change your content.
hughes 12y ago
Only with https could you be sure that your visitors are viewing the exact information you published, and that the content has not been hijacked. Over http it could conceivably have malicious or tracking content introduced without your knowledge.
pencilcode 12y ago
People could think they are reading an article from your site but actually they're not or the text was tampered with. With https you ensure people are actually reading what you published.
eyeface 12y ago
Sure! If I trust your site but not my ISP, then https allows me to trust the connection between us. That means that nobody can tamper with the content and inject some malicious JS. Also, the ISP could only tell that I am talking to your server, and not anything beyond that.
overshard 12y ago
If you're not using HTTPS it is trivial for anyone in the middle of the "client to server and back" connection to change any of the content. If you use HTTPS you prevent alterations to that traffic and people receive exactly what you expect they should receive. Examples of recent ISP misbehaving on non-https websites just 25 days ago on HN: https://news.ycombinator.com/item?id=8500131 https://news.ycombinator.com/item?id=8500131 Note that the Verizon issue isn't anything entirely content altering but someone who lives in a country with strict monitoring of traffic could easily change the wording of your website to match their propaganda if you aren't using HTTPS. So yes, your content is publicly available free stuff and no one is probably sending you user login credentials or credit cards but it still matters.
sp332 12y ago
Anyone along the way (like an ISP) could inject things into your webpage. Like ads https://arstechnica.com/tech-policy/2013/04/how-a-banner-ad-for-hs-ok/ https://arstechnica.com/tech-policy/2013/04/how-a-banner-ad-...
grey-area 12y ago
Is there any reason why I would want to use https for this use case? Yes it can help you stop: ISPs inserting adverts into your content (this has happened) Governments censoring your content or rewriting it Governments putting people in jail for reading your publicly available (in your country) content, which is illegal in theirs People impersonating your website But if you don't want to use it, that's cool too. I suspect all websites will be encrypted at some point soon though, the disadvantages are getting less and less important.
- pbhjpbhj 12y ago
  >Governments putting people in jail for reading your publicly available (in your country) content, which is illegal in theirs // How does that work, surely the gov can still see people accessing the information by monitoring network traffic and the info itself is still public. HTTPS doesn't encrypt the actual request traffic does it, and in any case the gov would still see which server the traffic is going to unless you're using something like tor [and possibly still then].
  - hdevalence 12y ago
    There's a difference between "User X browses Wikipedia" and "User X browses Wikipedia articles about topics A, B, C" where topics A, B, C could be anything user X doesn't want people recording them reading about: for instance, various political articles, articles about mental illness, articles about LGBT issues, etc. Fill in the blanks.
    - schoen 12y ago
      I use this example myself quite a bit, although we've also got to figure out the distinguishability from page sizes issue. Different Wikipedia pages are different sizes, and they're still different sizes when they're encrypted. One interesting idea I heard from someone recently is tuning compression so that you target a small number of total page sizes -- rather than padding to expand pages to the same sizes, just don't compress them all quite as well as you could have.
kstrauser 12y ago
Honestly, you're probably not going to get a large personal benefit from this. The larger good is that you'll be helping move the Internet toward encrypted-by-default, which is an enormous societal benefit. Like you, I don't host any private or remotely sensitive information. I'm encrypting my site because I think it's the right thing to do, even though there's little personal return on investment.

My website only contains publically available stuff for people to read. Is there any reason why I would want to use https for this use case? Or what does "entire web" mean?

aw3c2 12y ago

Yes, because it is no one's business what people are looking at anyways. If you have more than one URL, HTTPS will hide that. HTTPS will also make an attacker unable to change your content.

hughes 12y ago

Only with https could you be sure that your visitors are viewing the exact information you published, and that the content has not been hijacked. Over http it could conceivably have malicious or tracking content introduced without your knowledge.

pencilcode 12y ago

People could think they are reading an article from your site but actually they're not or the text was tampered with. With https you ensure people are actually reading what you published.

eyeface 12y ago

Sure! If I trust your site but not my ISP, then https allows me to trust the connection between us. That means that nobody can tamper with the content and inject some malicious JS. Also, the ISP could only tell that I am talking to your server, and not anything beyond that.

overshard 12y ago

If you're not using HTTPS it is trivial for anyone in the middle of the "client to server and back" connection to change any of the content. If you use HTTPS you prevent alterations to that traffic and people receive exactly what you expect they should receive. Examples of recent ISP misbehaving on non-https websites just 25 days ago on HN: https://news.ycombinator.com/item?id=8500131 https://news.ycombinator.com/item?id=8500131 Note that the Verizon issue isn't anything entirely content altering but someone who lives in a country with strict monitoring of traffic could easily change the wording of your website to match their propaganda if you aren't using HTTPS. So yes, your content is publicly available free stuff and no one is probably sending you user login credentials or credit cards but it still matters.

sp332 12y ago

Anyone along the way (like an ISP) could inject things into your webpage. Like ads https://arstechnica.com/tech-policy/2013/04/how-a-banner-ad-for-hs-ok/ https://arstechnica.com/tech-policy/2013/04/how-a-banner-ad-...

grey-area 12y ago

Is there any reason why I would want to use https for this use case? Yes it can help you stop: ISPs inserting adverts into your content (this has happened) Governments censoring your content or rewriting it Governments putting people in jail for reading your publicly available (in your country) content, which is illegal in theirs People impersonating your website But if you don't want to use it, that's cool too. I suspect all websites will be encrypted at some point soon though, the disadvantages are getting less and less important.

pbhjpbhj 12y ago
>Governments putting people in jail for reading your publicly available (in your country) content, which is illegal in theirs // How does that work, surely the gov can still see people accessing the information by monitoring network traffic and the info itself is still public. HTTPS doesn't encrypt the actual request traffic does it, and in any case the gov would still see which server the traffic is going to unless you're using something like tor [and possibly still then].
- hdevalence 12y ago
  There's a difference between "User X browses Wikipedia" and "User X browses Wikipedia articles about topics A, B, C" where topics A, B, C could be anything user X doesn't want people recording them reading about: for instance, various political articles, articles about mental illness, articles about LGBT issues, etc. Fill in the blanks.
  - schoen 12y ago
    I use this example myself quite a bit, although we've also got to figure out the distinguishability from page sizes issue. Different Wikipedia pages are different sizes, and they're still different sizes when they're encrypted. One interesting idea I heard from someone recently is tuning compression so that you target a small number of total page sizes -- rather than padding to expand pages to the same sizes, just don't compress them all quite as well as you could have.

kstrauser 12y ago

Honestly, you're probably not going to get a large personal benefit from this. The larger good is that you'll be helping move the Internet toward encrypted-by-default, which is an enormous societal benefit. Like you, I don't host any private or remotely sensitive information. I'm encrypting my site because I think it's the right thing to do, even though there's little personal return on investment.