35 ms·

A better approach would be, in my opinion, to only show insecurity when a <form> or user input is requested, i dont really see the use in https everywhere for s

by totony 12y ago

A better approach would be, in my opinion, to only show insecurity when a <form> or user input is requested, i dont really see the use in https everywhere for small static websites. DNS will still leak most of the websites you visit, so anonymity in this case is not really the issue that will be resolved.

troymc 12y ago
Here are five reasons why you might want to serve a small static website over https: https://www.bitballoon.com/blog/2014/10/03/five-reasons-you-want-https-for-your-static-site https://www.bitballoon.com/blog/2014/10/03/five-reasons-you-...
frabcus 12y ago
It can matter a lot which page you're visiting. Also, DNS can be secured later. When the EFF project to make and update free certificates for everyone launches, there's no reason not to put everything on HTTPS.
- zzzcpan 12y ago
  Work to install https-capable web server, get and install free certificate and support all that still needs to be done by someone and there is no such someone willing to do it for free for millions of websites. Cost is still significant for majority of websites.
Confiks 12y ago
DNS will only leak which hostname you visit, not which pages you access on that hostname. You hereby definitely resolve a privacy issue. Furthermore, the presence of a <form> element also looks like a very bad measure for 'protectworthy' information to me. Websites that require a user session to be established, need users to send a cookie for every request. Those requests need to be secure, or the sessions can be stolen.
- totony 12y ago
  Then, if there are sessions too, <form> was just an example. You're right for the path though, but for a majority of users, this doesn't matter, that is because a website often has a specific subject (porn, warez, etc), so if one DNS lookups the website, then that pretty much gives it all if the middle man is interested. Read: My opinion is that it's useless for most people, and is problematic for old infrastructures. Therefore there are as much benefit as negative effects, or more negative effects, so it doesn't seem worth it.

by totony 12y ago

troymc 12y ago

Here are five reasons why you might want to serve a small static website over https: https://www.bitballoon.com/blog/2014/10/03/five-reasons-you-want-https-for-your-static-site https://www.bitballoon.com/blog/2014/10/03/five-reasons-you-...

frabcus 12y ago

It can matter a lot which page you're visiting. Also, DNS can be secured later. When the EFF project to make and update free certificates for everyone launches, there's no reason not to put everything on HTTPS.

zzzcpan 12y ago
Work to install https-capable web server, get and install free certificate and support all that still needs to be done by someone and there is no such someone willing to do it for free for millions of websites. Cost is still significant for majority of websites.

Confiks 12y ago

DNS will only leak which hostname you visit, not which pages you access on that hostname. You hereby definitely resolve a privacy issue. Furthermore, the presence of a <form> element also looks like a very bad measure for 'protectworthy' information to me. Websites that require a user session to be established, need users to send a cookie for every request. Those requests need to be secure, or the sessions can be stolen.

totony 12y ago
Then, if there are sessions too, <form> was just an example. You're right for the path though, but for a majority of users, this doesn't matter, that is because a website often has a specific subject (porn, warez, etc), so if one DNS lookups the website, then that pretty much gives it all if the middle man is interested. Read: My opinion is that it's useless for most people, and is problematic for old infrastructures. Therefore there are as much benefit as negative effects, or more negative effects, so it doesn't seem worth it.