7 ms·

I still haven't heard a reason why it's important that my blog is on https. Waiting.

by Touche 12y ago

abdullahkhalids 12y ago
There is no reason. Your readers will probably not care that the browser tells them your cat pictures are being delivered to them in a non-secure manner. You shouldn't put in the work to switch over either. But in 2 years it will be easier for you to have a https blog than a http blog and you will naturally switch.
- MichaelGG 12y ago
  What about when a trusted cat blog starts providing instructions harmful to cats? Or a recipes site sends incorrect information regarding allergies?
mgraczyk 12y ago
Some users might want to be sure that the content of your blog as is rendered on their screen is truly the content of your blog. Or perhaps there are users who do not want others to know which specific posts on your blog they have viewed.
- Touche 12y ago
  Some users might not like my font choice either, but I don't think the browser should judge my site to be inferior because of that.
  - deleted 12y ago
    [deleted]
  - mayneack 12y ago
    If your site has auto-playing sound, would you be opposed to chrome adding the speaker indicator on the tab to alert users that your tab is causing the sound?
    - bpatrianakos 12y ago
      A speaker icon isn't making a judgement as to whether that sound is good or bad. Turning no-ssl into a warning is like having the browser judge you for being poor or cheap or incompetent. Not having HTTPS does not mean that you are insecure, it means the site isn't encrypted. There's a difference. Whether the lack of SSL makes you vulnerable to shenanigans depends on a lot of factors having nothing to do with SSL encryption and everything to do with the site content and what one may gain from snooping on your request or manipulating the response. Sometimes there's nothing to gain there.
      - alexhill 12y ago
        Some sites are in theory fine without encryption or an alert. Others are definitely not. The problem is that the browser (software) can't possibly know the difference, especially because the sites that "should" be encrypted is a matter of circumstance and varies from user to user. Some might say that the user should know the difference, but I think we can reasonably call that a huge cop-out. So in order to show an alert whenever sites that should be encrypted aren't, you just have to show an alert all the time. The SSL everywhere movement and Let's Encrypt are about making encryption easy enough for sites like yours that it's practical to do that. Basically, your site being encrypted, even if it doesn't specifically need to be, helps to improve security of the web as a whole.
  - rakoo 12y ago
    At least the browser knows the font choice is yours. The issue here is not with the content of your blog itself, but making sure it's integrity is preserved. Unless you use HTTPS, you don't know what content is sent to the browser, and you don't know who received it.
- bpatrianakos 12y ago
  I get your point but you're kind of blowing it out of proportion. A lot of people like myself host really mundane content and that concern is really the last thing on the minds of those types of site owners and their users. You want HTTPS when it's critical that no one manipulate the request and response but for most of us it's not worth the expense and effort. You want SSL on WebMD, Healthcare.gov, your bank website, and those political sites you read when no one is around but if some extra tracking get inserted into the response body of our favorite cat picture site then I think only you and I will notice or care. SSL everywhere isn't yet practical only due to the expense. It's not that much more effort to secure a site but when you run 10 sites then you're spending $100 a year for those domains. The expense of an SSL certificate each on top of that makes it impractical for solo "webmasters" to secure all their sites. We all know why we should use HTTPS and we do it when it makes sense but it's just not practical 100% of the time yet. Like others have said, this will make more sense once the EFF initiative starts being adopted and getting a free certificate is as easy as apt-get secure-me-please.
  - atonse 12y ago
    Ok sure, your blog has mundane content. But you might use a the same login for your blog as you do for your online banking (with minor changes to the password to make it more "secure", like adding a kid's birth year which people often do). Say you happen to login at a coffee shop, anyone sniffing your WIFI can now pick up your login because your traffic wasn't encrypted. Most people wouldn't be comfortable with a stranger looking over your shoulder while they logged in. This is the same thing, only you don't think about it. These things are ALL rare, but why would you want to expose yourself to this? SSL everywhere is also about improving security for those who don't realize that they might be engaging in behaviors that compromise their own security.
    - Semaphor 12y ago
      > But you might use a the same login for your blog as you do for your online banking That is a completely different problem that using https won't solve. It's like building a ship with a hole at the bottom and having a high throughput water pump.
mikepurvis 12y ago
Because it prevents your users' ISPs from inserting extra ads and analytics into your pages.
- yummyfajitas 12y ago
  While looking at my own (ad-free) blog I saw amitabh banchan selling me life insurance. I don't want my readers associating me with this: http://www.hkyantoyan.com/wp-content/uploads/2012/09/AB-binani.jpeg http://www.hkyantoyan.com/wp-content/uploads/2012/09/AB-bina... Switched to https shortly after.
- arielm 12y ago
  And also from them tracking what you read to give you specific advertisements. Man, it's really all about advertising these days...
dsl 12y ago
Because I can inject code into your page that infects visitors to your blog with malware. The NSAs QUANTUM system does exactly this, waiting for the targeted user to load a non-HTTPS page, then injecting javascript to redirect to an attack site.
- chc 12y ago
  AFAIK HTTPS does not by itself prevent this kind of attack. You need to authenticate the server as well as encrypt the connection or you could just be talking very privately to the NSA.
  - dsl 12y ago
    The browsers do a pretty good job of authenticating servers, and we have a few projects in place to look for rouge certificates. It's not perfect, but it will only get better.
    - jacquesm 12y ago
      Not that many rouge certificates to look for.
  - hueving 12y ago
    Uh, of course it does. If it didn't guarantee the server you were communicating with had the private key for the certificate it is presenting, it would be worthless.
    - coldtea 12y ago
      Yeah, because the NSA and such don't have access to certificate authorities in the first place, right?
      - kuschku 12y ago
        Which is why you are supposed to throw out untrustable Certificate Authorities. In the same way as TURKTRUST was thrown out by all vendors a few years ago, nowadays you should throw out VeriSign and GoDaddy just as well.
pdkl95 12y ago
1) Sometimes it's not about you. Currently, the NSA (and others, presumably) consider the presence of encryption as part of their is_suspicious() heuristic. Other people do have need for encryption, and by saying "I (currently) have nothing to hide", you are saying that you are fine with a high correlation between "uses encryption" and "is doing something suspicious". More than any other reason, we need to dilute that correlation until all data looks similar to remove the possibility of this kind of categorization. 2) https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html As Zimmermann said, we need to socially normalize the use of envelopes instead of the postcards that are currently used. Without that social expectation, it will be possible to legislate against the use of encryption in the future. 3) It lets us (in the very long term) simply retire 80/tcp ...and plain HTTP servers in general. Sure, this is a minor benefit, but it would still be nice.
- deleted 12y ago
  [deleted]
- coldtea 12y ago
  >Other people do have need for encryption, and by saying "I (currently) have nothing to hide", you are saying that you are fine with a high correlation between "uses encryption" and "is doing something suspicious". If those agencies had a problem with https, they wouldn't let a Google team popularize it. Https is, in all likelyhood, as transparent to them as a piece of glass.
  - pdkl95 12y ago
    Obviously, given that the TLAs can just national-security-letter a CA (if that's even necessary). That doesn't change anything about my recommendation. You should still use HTTPS, always. It still has an effect of making your traffic not stand out from anybody else's in a DPI. Also, the TLAs are not the only attacker, and HTTPS may not be transparent to them. The key feature is that it requires a MitM. That is not easy or cheap, compared to simply catch everything with a simple passive beam-splitter. The idea it is easy to get bulk data with XKEYSCORE/PRISM, but requiring the use of QUANTUM, FOXACID, and other fancier tools is not something that cannot be [cheap, undetected, used against everybody] simultaneously.
Buge 12y ago
If you have any https links on your site, those could be replaced by http links using something like sslstrip. Your site is now the weak link in the chain google->your site->linked site. Of course sites should be using HSTS to help prevent this, but if the user is visiting the linked site for the first time, HSTS can't protect them.
twistedpair 12y ago
Let's think of the idiocy of Slashdot not using SSL on their pages. It's now known that British intelligence services carried out MITM attacks of this popular tech watering hole to attack targets of interest. Given Slashdot knows this has happened and still, no SSL. Sure, they are not processing payment transactions onsite, but they can serve as a MITM puppet and don't seem concerned about this, surely because it might impinge on Dice's ad revenue. This is why all my blogs/sites are on SSL (or being converted in 1 case). Do you think people really check those md5sum's on the downloads from your OSS project page/blog? Make that unnecessary and use SSL. BTW, my CloudFront charges only went up 5% (i.e. a few bucks) and all my certs cost $2/ea because I stocked up at a sale. It's not a matter of money for most admins. The question is not "Why SSL" by "Why not?"
bad_user 12y ago
Here's a good one - some networks are injecting ads or trackers in the content served by your blog on said networks. HTTPS is a good way of signing your content.
bobfunk 12y ago
Someone posted it further down the comment thread, but anyway, here's a reason post I wrote on why you'll want HTTPS even for a static site: https://www.bitballoon.com/blog/2014/10/03/five-reasons-you-want-https-for-your-static-site https://www.bitballoon.com/blog/2014/10/03/five-reasons-you-...

I still haven't heard a reason why it's important that my blog is on https. Waiting.

by Touche 12y ago

I still haven't heard a reason why it's important that my blog is on https. Waiting.

There is no reason. Your readers will probably not care that the browser tells them your cat pictures are being delivered to them in a non-secure manner. You shouldn't put in the work to switch over either. But in 2 years it will be easier for you to have a https blog than a http blog and you will naturally switch.

MichaelGG 12y ago
What about when a trusted cat blog starts providing instructions harmful to cats? Or a recipes site sends incorrect information regarding allergies?

mgraczyk 12y ago

Some users might want to be sure that the content of your blog as is rendered on their screen is truly the content of your blog. Or perhaps there are users who do not want others to know which specific posts on your blog they have viewed.

Touche 12y ago
Some users might not like my font choice either, but I don't think the browser should judge my site to be inferior because of that.
- deleted 12y ago
  [deleted]
- mayneack 12y ago
  If your site has auto-playing sound, would you be opposed to chrome adding the speaker indicator on the tab to alert users that your tab is causing the sound?
  - bpatrianakos 12y ago
    A speaker icon isn't making a judgement as to whether that sound is good or bad. Turning no-ssl into a warning is like having the browser judge you for being poor or cheap or incompetent. Not having HTTPS does not mean that you are insecure, it means the site isn't encrypted. There's a difference. Whether the lack of SSL makes you vulnerable to shenanigans depends on a lot of factors having nothing to do with SSL encryption and everything to do with the site content and what one may gain from snooping on your request or manipulating the response. Sometimes there's nothing to gain there.
    - alexhill 12y ago
      Some sites are in theory fine without encryption or an alert. Others are definitely not. The problem is that the browser (software) can't possibly know the difference, especially because the sites that "should" be encrypted is a matter of circumstance and varies from user to user. Some might say that the user should know the difference, but I think we can reasonably call that a huge cop-out. So in order to show an alert whenever sites that should be encrypted aren't, you just have to show an alert all the time. The SSL everywhere movement and Let's Encrypt are about making encryption easy enough for sites like yours that it's practical to do that. Basically, your site being encrypted, even if it doesn't specifically need to be, helps to improve security of the web as a whole.
- rakoo 12y ago
  At least the browser knows the font choice is yours. The issue here is not with the content of your blog itself, but making sure it's integrity is preserved. Unless you use HTTPS, you don't know what content is sent to the browser, and you don't know who received it.
bpatrianakos 12y ago
I get your point but you're kind of blowing it out of proportion. A lot of people like myself host really mundane content and that concern is really the last thing on the minds of those types of site owners and their users. You want HTTPS when it's critical that no one manipulate the request and response but for most of us it's not worth the expense and effort. You want SSL on WebMD, Healthcare.gov, your bank website, and those political sites you read when no one is around but if some extra tracking get inserted into the response body of our favorite cat picture site then I think only you and I will notice or care. SSL everywhere isn't yet practical only due to the expense. It's not that much more effort to secure a site but when you run 10 sites then you're spending $100 a year for those domains. The expense of an SSL certificate each on top of that makes it impractical for solo "webmasters" to secure all their sites. We all know why we should use HTTPS and we do it when it makes sense but it's just not practical 100% of the time yet. Like others have said, this will make more sense once the EFF initiative starts being adopted and getting a free certificate is as easy as apt-get secure-me-please.
- atonse 12y ago
  Ok sure, your blog has mundane content. But you might use a the same login for your blog as you do for your online banking (with minor changes to the password to make it more "secure", like adding a kid's birth year which people often do). Say you happen to login at a coffee shop, anyone sniffing your WIFI can now pick up your login because your traffic wasn't encrypted. Most people wouldn't be comfortable with a stranger looking over your shoulder while they logged in. This is the same thing, only you don't think about it. These things are ALL rare, but why would you want to expose yourself to this? SSL everywhere is also about improving security for those who don't realize that they might be engaging in behaviors that compromise their own security.
  - Semaphor 12y ago
    > But you might use a the same login for your blog as you do for your online banking That is a completely different problem that using https won't solve. It's like building a ship with a hole at the bottom and having a high throughput water pump.

mikepurvis 12y ago

Because it prevents your users' ISPs from inserting extra ads and analytics into your pages.

yummyfajitas 12y ago
While looking at my own (ad-free) blog I saw amitabh banchan selling me life insurance. I don't want my readers associating me with this: http://www.hkyantoyan.com/wp-content/uploads/2012/09/AB-binani.jpeg http://www.hkyantoyan.com/wp-content/uploads/2012/09/AB-bina... Switched to https shortly after.
arielm 12y ago
And also from them tracking what you read to give you specific advertisements. Man, it's really all about advertising these days...

dsl 12y ago

Because I can inject code into your page that infects visitors to your blog with malware. The NSAs QUANTUM system does exactly this, waiting for the targeted user to load a non-HTTPS page, then injecting javascript to redirect to an attack site.

chc 12y ago
AFAIK HTTPS does not by itself prevent this kind of attack. You need to authenticate the server as well as encrypt the connection or you could just be talking very privately to the NSA.
- dsl 12y ago
  The browsers do a pretty good job of authenticating servers, and we have a few projects in place to look for rouge certificates. It's not perfect, but it will only get better.
  - jacquesm 12y ago
    Not that many rouge certificates to look for.
- hueving 12y ago
  Uh, of course it does. If it didn't guarantee the server you were communicating with had the private key for the certificate it is presenting, it would be worthless.
  - coldtea 12y ago
    Yeah, because the NSA and such don't have access to certificate authorities in the first place, right?
    - kuschku 12y ago
      Which is why you are supposed to throw out untrustable Certificate Authorities. In the same way as TURKTRUST was thrown out by all vendors a few years ago, nowadays you should throw out VeriSign and GoDaddy just as well.

pdkl95 12y ago

1) Sometimes it's not about you. Currently, the NSA (and others, presumably) consider the presence of encryption as part of their is_suspicious() heuristic. Other people do have need for encryption, and by saying "I (currently) have nothing to hide", you are saying that you are fine with a high correlation between "uses encryption" and "is doing something suspicious". More than any other reason, we need to dilute that correlation until all data looks similar to remove the possibility of this kind of categorization. 2) https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html As Zimmermann said, we need to socially normalize the use of envelopes instead of the postcards that are currently used. Without that social expectation, it will be possible to legislate against the use of encryption in the future. 3) It lets us (in the very long term) simply retire 80/tcp ...and plain HTTP servers in general. Sure, this is a minor benefit, but it would still be nice.

deleted 12y ago
[deleted]
coldtea 12y ago
>Other people do have need for encryption, and by saying "I (currently) have nothing to hide", you are saying that you are fine with a high correlation between "uses encryption" and "is doing something suspicious". If those agencies had a problem with https, they wouldn't let a Google team popularize it. Https is, in all likelyhood, as transparent to them as a piece of glass.
- pdkl95 12y ago
  Obviously, given that the TLAs can just national-security-letter a CA (if that's even necessary). That doesn't change anything about my recommendation. You should still use HTTPS, always. It still has an effect of making your traffic not stand out from anybody else's in a DPI. Also, the TLAs are not the only attacker, and HTTPS may not be transparent to them. The key feature is that it requires a MitM. That is not easy or cheap, compared to simply catch everything with a simple passive beam-splitter. The idea it is easy to get bulk data with XKEYSCORE/PRISM, but requiring the use of QUANTUM, FOXACID, and other fancier tools is not something that cannot be [cheap, undetected, used against everybody] simultaneously.

Buge 12y ago

If you have any https links on your site, those could be replaced by http links using something like sslstrip. Your site is now the weak link in the chain google->your site->linked site. Of course sites should be using HSTS to help prevent this, but if the user is visiting the linked site for the first time, HSTS can't protect them.

twistedpair 12y ago

Let's think of the idiocy of Slashdot not using SSL on their pages. It's now known that British intelligence services carried out MITM attacks of this popular tech watering hole to attack targets of interest. Given Slashdot knows this has happened and still, no SSL. Sure, they are not processing payment transactions onsite, but they can serve as a MITM puppet and don't seem concerned about this, surely because it might impinge on Dice's ad revenue. This is why all my blogs/sites are on SSL (or being converted in 1 case). Do you think people really check those md5sum's on the downloads from your OSS project page/blog? Make that unnecessary and use SSL. BTW, my CloudFront charges only went up 5% (i.e. a few bucks) and all my certs cost $2/ea because I stocked up at a sale. It's not a matter of money for most admins. The question is not "Why SSL" by "Why not?"

bad_user 12y ago

Here's a good one - some networks are injecting ads or trackers in the content served by your blog on said networks. HTTPS is a good way of signing your content.

bobfunk 12y ago

Someone posted it further down the comment thread, but anyway, here's a reason post I wrote on why you'll want HTTPS even for a static site: https://www.bitballoon.com/blog/2014/10/03/five-reasons-you-want-https-for-your-static-site https://www.bitballoon.com/blog/2014/10/03/five-reasons-you-...