8 ms·

I think the best time to do this would be soon after the Let's Encrpyt free CA [1] starts handing out certificates. There's no more good reason not to have HTT

I think the best time to do this would be soon after the Let's Encrpyt free CA [1] starts handing out certificates. There's no more good reason not to have HTTPS, so that's a good time to start applying a little pressure and adding the incentive for website authors. Does google already reward secure sites with higher search rankings? I can't decide if I think that's a good idea or not, but if they want to push for a more secure and free web, that's definitely another avenue. [1] https://www.eff.org/press/releases/new-free-certificate-authority-dramatically-increase-encrypted-internet-traffic https://www.eff.org/press/releases/new-free-certificate-auth...

TimWolla 12y ago
> Does google already reward secure sites with higher search rankings? They do: http://googlewebmastercentral.blogspot.de/2014/08/https-as-ranking-signal.html http://googlewebmastercentral.blogspot.de/2014/08/https-as-r...
alexbecker 12y ago
> Does google already reward secure sites with higher search rankings? Yes, although only recently and only slightly. http://googlewebmastercentral.blogspot.com/2014/08/https-as-ranking-signal.html http://googlewebmastercentral.blogspot.com/2014/08/https-as-...
Touche 12y ago
I still haven't heard a reason why it's important that my blog is on https. Waiting.
- abdullahkhalids 12y ago
  There is no reason. Your readers will probably not care that the browser tells them your cat pictures are being delivered to them in a non-secure manner. You shouldn't put in the work to switch over either. But in 2 years it will be easier for you to have a https blog than a http blog and you will naturally switch.
  - MichaelGG 12y ago
    What about when a trusted cat blog starts providing instructions harmful to cats? Or a recipes site sends incorrect information regarding allergies?
- mgraczyk 12y ago
  Some users might want to be sure that the content of your blog as is rendered on their screen is truly the content of your blog. Or perhaps there are users who do not want others to know which specific posts on your blog they have viewed.
  - Touche 12y ago
    Some users might not like my font choice either, but I don't think the browser should judge my site to be inferior because of that.
    - deleted 12y ago
      [deleted]
    - mayneack 12y ago
      If your site has auto-playing sound, would you be opposed to chrome adding the speaker indicator on the tab to alert users that your tab is causing the sound?
      - bpatrianakos 12y ago
        A speaker icon isn't making a judgement as to whether that sound is good or bad. Turning no-ssl into a warning is like having the browser judge you for being poor or cheap or incompetent. Not having HTTPS does not mean that you are insecure, it means the site isn't encrypted. There's a difference. Whether the lack of SSL makes you vulnerable to shenanigans depends on a lot of factors having nothing to do with SSL encryption and everything to do with the site content and what one may gain from snooping on your request or manipulating the response. Sometimes there's nothing to gain there.
        alexhill 12y ago
        Some sites are in theory fine without encryption or an alert. Others are definitely not. The problem is that the browser (software) can't possibly know the difference, especially because the sites that "should" be encrypted is a matter of circumstance and varies from user to user. Some might say that the user should know the difference, but I think we can reasonably call that a huge cop-out. So in order to show an alert whenever sites that should be encrypted aren't, you just have to show an alert all the time. The SSL everywhere movement and Let's Encrypt are about making encryption easy enough for sites like yours that it's practical to do that. Basically, your site being encrypted, even if it doesn't specifically need to be, helps to improve security of the web as a whole.
- mikepurvis 12y ago
  Because it prevents your users' ISPs from inserting extra ads and analytics into your pages.
  - yummyfajitas 12y ago
    While looking at my own (ad-free) blog I saw amitabh banchan selling me life insurance. I don't want my readers associating me with this: http://www.hkyantoyan.com/wp-content/uploads/2012/09/AB-binani.jpeg http://www.hkyantoyan.com/wp-content/uploads/2012/09/AB-bina... Switched to https shortly after.
  - arielm 12y ago
    And also from them tracking what you read to give you specific advertisements. Man, it's really all about advertising these days...
- dsl 12y ago
  Because I can inject code into your page that infects visitors to your blog with malware. The NSAs QUANTUM system does exactly this, waiting for the targeted user to load a non-HTTPS page, then injecting javascript to redirect to an attack site.
  - chc 12y ago
    AFAIK HTTPS does not by itself prevent this kind of attack. You need to authenticate the server as well as encrypt the connection or you could just be talking very privately to the NSA.
    - dsl 12y ago
      The browsers do a pretty good job of authenticating servers, and we have a few projects in place to look for rouge certificates. It's not perfect, but it will only get better.
      - jacquesm 12y ago
        Not that many rouge certificates to look for.
    - hueving 12y ago
      Uh, of course it does. If it didn't guarantee the server you were communicating with had the private key for the certificate it is presenting, it would be worthless.
      - coldtea 12y ago
        Yeah, because the NSA and such don't have access to certificate authorities in the first place, right?
        kuschku 12y ago
        Which is why you are supposed to throw out untrustable Certificate Authorities. In the same way as TURKTRUST was thrown out by all vendors a few years ago, nowadays you should throw out VeriSign and GoDaddy just as well.
- pdkl95 12y ago
  1) Sometimes it's not about you. Currently, the NSA (and others, presumably) consider the presence of encryption as part of their is_suspicious() heuristic. Other people do have need for encryption, and by saying "I (currently) have nothing to hide", you are saying that you are fine with a high correlation between "uses encryption" and "is doing something suspicious". More than any other reason, we need to dilute that correlation until all data looks similar to remove the possibility of this kind of categorization. 2) https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html As Zimmermann said, we need to socially normalize the use of envelopes instead of the postcards that are currently used. Without that social expectation, it will be possible to legislate against the use of encryption in the future. 3) It lets us (in the very long term) simply retire 80/tcp ...and plain HTTP servers in general. Sure, this is a minor benefit, but it would still be nice.
  - deleted 12y ago
    [deleted]
  - coldtea 12y ago
    >Other people do have need for encryption, and by saying "I (currently) have nothing to hide", you are saying that you are fine with a high correlation between "uses encryption" and "is doing something suspicious". If those agencies had a problem with https, they wouldn't let a Google team popularize it. Https is, in all likelyhood, as transparent to them as a piece of glass.
    - pdkl95 12y ago
      Obviously, given that the TLAs can just national-security-letter a CA (if that's even necessary). That doesn't change anything about my recommendation. You should still use HTTPS, always. It still has an effect of making your traffic not stand out from anybody else's in a DPI. Also, the TLAs are not the only attacker, and HTTPS may not be transparent to them. The key feature is that it requires a MitM. That is not easy or cheap, compared to simply catch everything with a simple passive beam-splitter. The idea it is easy to get bulk data with XKEYSCORE/PRISM, but requiring the use of QUANTUM, FOXACID, and other fancier tools is not something that cannot be [cheap, undetected, used against everybody] simultaneously.
- Buge 12y ago
  If you have any https links on your site, those could be replaced by http links using something like sslstrip. Your site is now the weak link in the chain google->your site->linked site. Of course sites should be using HSTS to help prevent this, but if the user is visiting the linked site for the first time, HSTS can't protect them.
- twistedpair 12y ago
  Let's think of the idiocy of Slashdot not using SSL on their pages. It's now known that British intelligence services carried out MITM attacks of this popular tech watering hole to attack targets of interest. Given Slashdot knows this has happened and still, no SSL. Sure, they are not processing payment transactions onsite, but they can serve as a MITM puppet and don't seem concerned about this, surely because it might impinge on Dice's ad revenue. This is why all my blogs/sites are on SSL (or being converted in 1 case). Do you think people really check those md5sum's on the downloads from your OSS project page/blog? Make that unnecessary and use SSL. BTW, my CloudFront charges only went up 5% (i.e. a few bucks) and all my certs cost $2/ea because I stocked up at a sale. It's not a matter of money for most admins. The question is not "Why SSL" by "Why not?"
- bad_user 12y ago
  Here's a good one - some networks are injecting ads or trackers in the content served by your blog on said networks. HTTPS is a good way of signing your content.
- bobfunk 12y ago
  Someone posted it further down the comment thread, but anyway, here's a reason post I wrote on why you'll want HTTPS even for a static site: https://www.bitballoon.com/blog/2014/10/03/five-reasons-you-want-https-for-your-static-site https://www.bitballoon.com/blog/2014/10/03/five-reasons-you-...
Donzo 12y ago
There is a very good reason to not secure your site if you are dependent on ad revenue. When I switched to https, my earnings dropped by about half. I tried it for a week, but I couldn't take the losses. When you have a secure site that uses Adsense, Google only serves ads from secure ad servers. This shrinks the pool of competing bidders significantly. For me to switch back, either Google needs to push advertising networks into securing their ad servers, or the nonsecure warning will have to be really big and scary.
- hashtree 12y ago
  This is a really interesting observation. Can you expand upon what "shrinks the pool of competing bidders significantly" means? For instance, when creating an Ad Words campaign, is there a setting/option that they must opt-in to and if they do not they won't be considered for secure-only advertising?
  - taspeotis 12y ago
    I'm guessing it means that ads that lead to http:// http:// urls get binned.
    - coldtea 12y ago
      No, ads that originate from such urls get binned.
  - Donzo 12y ago
    Here is relevant information about it taken from this page: https://support.google.com/adsense/answer/10528?hl=en https://support.google.com/adsense/answer/10528?hl=en "HTTPS-enabled sites require that all content on the page, including the ads, be SSL-compliant. As such, AdSense will remove all non-SSL compliant ads from competing in the auction on these pages. If you do decide to convert your HTTP site to HTTPS, please be aware that because we remove non-SSL compliant ads from the auction, thereby reducing auction pressure, ads on your HTTPS pages might earn less than those on your HTTP pages."
  - 12y ago
jedberg 12y ago
> There's no more good reason not to have HTTPS Cost. Today I host my website for 6 cents a month as a static page on Amazon S3. To go https, I'd have to first acquire a certificate (lucky that can be free and with Let's Encrypt will be). Then I have to find someone to host that certificate. I can pay someone hundreds to thousands of dollars in setup and monthly fees. Or, the cheapest option I've found is to get a $6/mo VPS as a frontend, put nginx on it, and put my cert there. The problem is that costs 100 times as much as what I pay now, and I have to maintain a server and it's not served from multiple redundant servers like my site is now. Or I can use Amazon's free SNI support, making it so that older browsers can't see my site and I have no way of blocking people from using http or redirecting them. There is currently no good, cheap option to do SSL only that is viewable by everyone. That's why I haven't switched yet.
- coldtea 12y ago
  >The problem is that costs 100 times as much as what I pay now The "100 times as much" is not that impressive, if it merely goes from 6 cents to 6 dollars.
  - egwor 12y ago
    Which in big chunks of the western world is not that much, but it will increase the barrier for entry for many in poorer nations. For commercial sites, then maybe I see a benefit. For everything else... why bother? The info isn't secret, doesn't need to be and since there's so much data going around already is anyone malicious bothering to look?
  - ctz 12y ago
    I suggest looking at the world beyond your immediate environs. 6 cents vs 6 dollars is the difference between a person in a low-income economy spending 0.1% vs 18% of their income on a website.
    - Mister_Snuggles 12y ago
      That works out to an income of about $33/mo. I think that person has a lot more to worry about than where to host their static site.
higherpurpose 12y ago
They do: http://googlewebmastercentral.blogspot.com/2014/08/https-as-ranking-signal.html http://googlewebmastercentral.blogspot.com/2014/08/https-as-...
nickfox 12y ago
I have no idea what you people are talking about. All of my websites are https but the problem I have is that Google is NOT serving data from secure servers. Open the chrome console on my webpage here and look at all of the errors and warnings. All because Google refuses to serve secure content despite people complaining for YEARS in the forums. https://www.websmithing.com/gpstracker/displaymap.php https://www.websmithing.com/gpstracker/displaymap.php Can't Google spend a little more time securing their own websites instead of telling everyone else to secure theirs?

TimWolla 12y ago

> Does google already reward secure sites with higher search rankings? They do: http://googlewebmastercentral.blogspot.de/2014/08/https-as-ranking-signal.html http://googlewebmastercentral.blogspot.de/2014/08/https-as-r...

alexbecker 12y ago

> Does google already reward secure sites with higher search rankings? Yes, although only recently and only slightly. http://googlewebmastercentral.blogspot.com/2014/08/https-as-ranking-signal.html http://googlewebmastercentral.blogspot.com/2014/08/https-as-...

Touche 12y ago

I still haven't heard a reason why it's important that my blog is on https. Waiting.

abdullahkhalids 12y ago
There is no reason. Your readers will probably not care that the browser tells them your cat pictures are being delivered to them in a non-secure manner. You shouldn't put in the work to switch over either. But in 2 years it will be easier for you to have a https blog than a http blog and you will naturally switch.
- MichaelGG 12y ago
  What about when a trusted cat blog starts providing instructions harmful to cats? Or a recipes site sends incorrect information regarding allergies?
mgraczyk 12y ago
Some users might want to be sure that the content of your blog as is rendered on their screen is truly the content of your blog. Or perhaps there are users who do not want others to know which specific posts on your blog they have viewed.
- Touche 12y ago
  Some users might not like my font choice either, but I don't think the browser should judge my site to be inferior because of that.
  - deleted 12y ago
    [deleted]
  - mayneack 12y ago
    If your site has auto-playing sound, would you be opposed to chrome adding the speaker indicator on the tab to alert users that your tab is causing the sound?
    - bpatrianakos 12y ago
      A speaker icon isn't making a judgement as to whether that sound is good or bad. Turning no-ssl into a warning is like having the browser judge you for being poor or cheap or incompetent. Not having HTTPS does not mean that you are insecure, it means the site isn't encrypted. There's a difference. Whether the lack of SSL makes you vulnerable to shenanigans depends on a lot of factors having nothing to do with SSL encryption and everything to do with the site content and what one may gain from snooping on your request or manipulating the response. Sometimes there's nothing to gain there.
      - alexhill 12y ago
        Some sites are in theory fine without encryption or an alert. Others are definitely not. The problem is that the browser (software) can't possibly know the difference, especially because the sites that "should" be encrypted is a matter of circumstance and varies from user to user. Some might say that the user should know the difference, but I think we can reasonably call that a huge cop-out. So in order to show an alert whenever sites that should be encrypted aren't, you just have to show an alert all the time. The SSL everywhere movement and Let's Encrypt are about making encryption easy enough for sites like yours that it's practical to do that. Basically, your site being encrypted, even if it doesn't specifically need to be, helps to improve security of the web as a whole.
mikepurvis 12y ago
Because it prevents your users' ISPs from inserting extra ads and analytics into your pages.
- yummyfajitas 12y ago
  While looking at my own (ad-free) blog I saw amitabh banchan selling me life insurance. I don't want my readers associating me with this: http://www.hkyantoyan.com/wp-content/uploads/2012/09/AB-binani.jpeg http://www.hkyantoyan.com/wp-content/uploads/2012/09/AB-bina... Switched to https shortly after.
- arielm 12y ago
  And also from them tracking what you read to give you specific advertisements. Man, it's really all about advertising these days...
dsl 12y ago
Because I can inject code into your page that infects visitors to your blog with malware. The NSAs QUANTUM system does exactly this, waiting for the targeted user to load a non-HTTPS page, then injecting javascript to redirect to an attack site.
- chc 12y ago
  AFAIK HTTPS does not by itself prevent this kind of attack. You need to authenticate the server as well as encrypt the connection or you could just be talking very privately to the NSA.
  - dsl 12y ago
    The browsers do a pretty good job of authenticating servers, and we have a few projects in place to look for rouge certificates. It's not perfect, but it will only get better.
    - jacquesm 12y ago
      Not that many rouge certificates to look for.
  - hueving 12y ago
    Uh, of course it does. If it didn't guarantee the server you were communicating with had the private key for the certificate it is presenting, it would be worthless.
    - coldtea 12y ago
      Yeah, because the NSA and such don't have access to certificate authorities in the first place, right?
      - kuschku 12y ago
        Which is why you are supposed to throw out untrustable Certificate Authorities. In the same way as TURKTRUST was thrown out by all vendors a few years ago, nowadays you should throw out VeriSign and GoDaddy just as well.
pdkl95 12y ago
1) Sometimes it's not about you. Currently, the NSA (and others, presumably) consider the presence of encryption as part of their is_suspicious() heuristic. Other people do have need for encryption, and by saying "I (currently) have nothing to hide", you are saying that you are fine with a high correlation between "uses encryption" and "is doing something suspicious". More than any other reason, we need to dilute that correlation until all data looks similar to remove the possibility of this kind of categorization. 2) https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html As Zimmermann said, we need to socially normalize the use of envelopes instead of the postcards that are currently used. Without that social expectation, it will be possible to legislate against the use of encryption in the future. 3) It lets us (in the very long term) simply retire 80/tcp ...and plain HTTP servers in general. Sure, this is a minor benefit, but it would still be nice.
- deleted 12y ago
  [deleted]
- coldtea 12y ago
  >Other people do have need for encryption, and by saying "I (currently) have nothing to hide", you are saying that you are fine with a high correlation between "uses encryption" and "is doing something suspicious". If those agencies had a problem with https, they wouldn't let a Google team popularize it. Https is, in all likelyhood, as transparent to them as a piece of glass.
  - pdkl95 12y ago
    Obviously, given that the TLAs can just national-security-letter a CA (if that's even necessary). That doesn't change anything about my recommendation. You should still use HTTPS, always. It still has an effect of making your traffic not stand out from anybody else's in a DPI. Also, the TLAs are not the only attacker, and HTTPS may not be transparent to them. The key feature is that it requires a MitM. That is not easy or cheap, compared to simply catch everything with a simple passive beam-splitter. The idea it is easy to get bulk data with XKEYSCORE/PRISM, but requiring the use of QUANTUM, FOXACID, and other fancier tools is not something that cannot be [cheap, undetected, used against everybody] simultaneously.
Buge 12y ago
If you have any https links on your site, those could be replaced by http links using something like sslstrip. Your site is now the weak link in the chain google->your site->linked site. Of course sites should be using HSTS to help prevent this, but if the user is visiting the linked site for the first time, HSTS can't protect them.
twistedpair 12y ago
Let's think of the idiocy of Slashdot not using SSL on their pages. It's now known that British intelligence services carried out MITM attacks of this popular tech watering hole to attack targets of interest. Given Slashdot knows this has happened and still, no SSL. Sure, they are not processing payment transactions onsite, but they can serve as a MITM puppet and don't seem concerned about this, surely because it might impinge on Dice's ad revenue. This is why all my blogs/sites are on SSL (or being converted in 1 case). Do you think people really check those md5sum's on the downloads from your OSS project page/blog? Make that unnecessary and use SSL. BTW, my CloudFront charges only went up 5% (i.e. a few bucks) and all my certs cost $2/ea because I stocked up at a sale. It's not a matter of money for most admins. The question is not "Why SSL" by "Why not?"
bad_user 12y ago
Here's a good one - some networks are injecting ads or trackers in the content served by your blog on said networks. HTTPS is a good way of signing your content.
bobfunk 12y ago
Someone posted it further down the comment thread, but anyway, here's a reason post I wrote on why you'll want HTTPS even for a static site: https://www.bitballoon.com/blog/2014/10/03/five-reasons-you-want-https-for-your-static-site https://www.bitballoon.com/blog/2014/10/03/five-reasons-you-...

Donzo 12y ago

There is a very good reason to not secure your site if you are dependent on ad revenue. When I switched to https, my earnings dropped by about half. I tried it for a week, but I couldn't take the losses. When you have a secure site that uses Adsense, Google only serves ads from secure ad servers. This shrinks the pool of competing bidders significantly. For me to switch back, either Google needs to push advertising networks into securing their ad servers, or the nonsecure warning will have to be really big and scary.

hashtree 12y ago
This is a really interesting observation. Can you expand upon what "shrinks the pool of competing bidders significantly" means? For instance, when creating an Ad Words campaign, is there a setting/option that they must opt-in to and if they do not they won't be considered for secure-only advertising?
- taspeotis 12y ago
  I'm guessing it means that ads that lead to http:// http:// urls get binned.
  - coldtea 12y ago
    No, ads that originate from such urls get binned.
- Donzo 12y ago
  Here is relevant information about it taken from this page: https://support.google.com/adsense/answer/10528?hl=en https://support.google.com/adsense/answer/10528?hl=en "HTTPS-enabled sites require that all content on the page, including the ads, be SSL-compliant. As such, AdSense will remove all non-SSL compliant ads from competing in the auction on these pages. If you do decide to convert your HTTP site to HTTPS, please be aware that because we remove non-SSL compliant ads from the auction, thereby reducing auction pressure, ads on your HTTPS pages might earn less than those on your HTTP pages."
- 12y ago

jedberg 12y ago

> There's no more good reason not to have HTTPS Cost. Today I host my website for 6 cents a month as a static page on Amazon S3. To go https, I'd have to first acquire a certificate (lucky that can be free and with Let's Encrypt will be). Then I have to find someone to host that certificate. I can pay someone hundreds to thousands of dollars in setup and monthly fees. Or, the cheapest option I've found is to get a $6/mo VPS as a frontend, put nginx on it, and put my cert there. The problem is that costs 100 times as much as what I pay now, and I have to maintain a server and it's not served from multiple redundant servers like my site is now. Or I can use Amazon's free SNI support, making it so that older browsers can't see my site and I have no way of blocking people from using http or redirecting them. There is currently no good, cheap option to do SSL only that is viewable by everyone. That's why I haven't switched yet.

coldtea 12y ago
>The problem is that costs 100 times as much as what I pay now The "100 times as much" is not that impressive, if it merely goes from 6 cents to 6 dollars.
- egwor 12y ago
  Which in big chunks of the western world is not that much, but it will increase the barrier for entry for many in poorer nations. For commercial sites, then maybe I see a benefit. For everything else... why bother? The info isn't secret, doesn't need to be and since there's so much data going around already is anyone malicious bothering to look?
- ctz 12y ago
  I suggest looking at the world beyond your immediate environs. 6 cents vs 6 dollars is the difference between a person in a low-income economy spending 0.1% vs 18% of their income on a website.
  - Mister_Snuggles 12y ago
    That works out to an income of about $33/mo. I think that person has a lot more to worry about than where to host their static site.

higherpurpose 12y ago

They do: http://googlewebmastercentral.blogspot.com/2014/08/https-as-ranking-signal.html http://googlewebmastercentral.blogspot.com/2014/08/https-as-...

nickfox 12y ago

I have no idea what you people are talking about. All of my websites are https but the problem I have is that Google is NOT serving data from secure servers. Open the chrome console on my webpage here and look at all of the errors and warnings. All because Google refuses to serve secure content despite people complaining for YEARS in the forums. https://www.websmithing.com/gpstracker/displaymap.php https://www.websmithing.com/gpstracker/displaymap.php Can't Google spend a little more time securing their own websites instead of telling everyone else to secure theirs?