6 ms·
Once Let's Ecrypt [0] launches, I suppose most web developers won't have any more excuses not to use HTTPS. It'll be free, pretty easy and quick time wise, plus
by thomasfoster96 12y ago
Once Let's Ecrypt [0] launches, I suppose most web developers won't have any more excuses not to use HTTPS. It'll be free, pretty easy and quick time wise, plus it'll give you an SEO boost.
Browser vendors are certainly doing the right thing by making http be marked as non-secure, and not implementing unencrypted http/2 and not allowing non-HTTPS access to powerful api are completely reasonable steps to take.
[0] https://letsencrypt.org https://letsencrypt.org
- psykovsky 12y agoIf everybody gets an SEO boost, there is no boost. :)
- hucker 12y agoWell, then there's a SEO penalty for not using it...
- solaris999 12y agoIf you want to be pessimistic about it, anyone who doesn't adopt will get an SEO drop
- Aldo_MX 12y agoExcept that not everybody will do it since day 1
- TazeTSchnitzel 12y agoWhat about HTTPS for local testing, though?
- thomasfoster96 12y agoReading through the W3C draft linked to in the announcement, localhost over HTTP will be considered probably secure.
- TazeTSchnitzel 12y agoMake sense: if you can run a web server, you don't need the browser's help to do a phishing attack.
- organsnyder 12y agoNot necessarily. Any user could run a web server on an unprivileged port. While this is a far-fetched scenario—it requires the attacker having access to a different user's account on the machine, but not the victim's (if they had access to the victim's account, they wouldn't need to take these measures)—it is possible. The only solution is to restrict privileged status to privileged ports. However, that would also limit the usefulness of the exception, since dev servers usually run on unprivileged ports (that could be changed, of course).
- thomasfoster96 12y agoI might suppose that web browser developers might be of the view that if someone has been able to run a web server on your computer (even under a different user account) and done so with malicious intentions, your security problems are beyond the control of a web browser. With that sort of access, the attacker might as well have made off with all of your HTTPS-only cookies and browser history, changed your DNS settings, etc.
- RyanMcGreal 12y agoHow will Let's Encrypt be different/better than a StartSSL Free certificate?
- organsnyder 12y agoI used to use StartSSL, but abandoned it for a few reasons: 1. Their user interface is slow and clunky. Acquiring/renewing certificates is a PITA. 2. For organizations, they require both extended personal validation and organizational validation. In addition to being fairly expensive ($100 annually, each), they require you to send images of a bunch of sensitive personal documents (passport, credit card, etc.). While you can often slip by and get certs without them realizing you're getting them for an organization, once they've noticed and flagged your account, each cert requires manual review. 3. Their website hasn't been updated in a number of years. They do not give the impression of being a healthy company.
- icebraining 12y agoFree certificate revocations. StartSSL was crucified for charging $25 for revocations, and not waiving the fee during Heartbleed.
- AlyssaRowan 12y agoThis, 100%. They also plan to adopt Certificate Transparency, I believe. And it'll hopefully be trivial to set up, once the scripting is all finished. No excuses, people. Give it a few years and we'll be seriously talking about turning http: off, or at least putting security warnings on it, denying cookies and scripting, etc. You don't still use telnet, do you?
- thomasfoster96 12y agoBy the looks of the Github account, Let's Encrypt will let me programmatically get a certificate for free when I run non start in my node app, or easily set up HTTPS on my Apache web server, among other things. All for free with minimal work.
- tlarkworthy 12y agoIts two commands for free static https hosting on Firebase https://www.firebase.com/docs/hosting/command-line-tool.html https://www.firebase.com/docs/hosting/command-line-tool.html
- protomyth 12y agoWhat is the value proposition of a certificate from an automated provider? What is the verification? If someone wants to get a certificate for a domain that has ebay or paypal as part of the domain then spoofs those sites, will the automated provide flag this or are the users going to see the nice lock in their address bar? Why bother and not just allow all self signed certificates?
- goodnights 12y agohttps://letsencrypt.org/howitworks/technology/ https://letsencrypt.org/howitworks/technology/
- protomyth 12y agoOk, so how does that keep a site like paypall.com (or any example of a common off-by-one-letter domain) from getting a certificate?
- Eridrus 12y agoNothing currently stops paypall.com getting a certificate and the technology is not meant to do that. EV-SSL is kind of meant to deal with that if you want to pay the fees. But this seems more in line with a movement towards HTTPS by default and marking HTTP as insecure.
- protomyth 12y agoI'm pretty sure the certificate companies when doing their verification stop obvious attempts at scams. So, all this is to get an encrypted connection?
- runeks 12y ago> So, all this is to get an encrypted connection? This strikes me as odd too. What's the difference between an automated SSL certificate generator and just having the browser accept self-signed certificates? openssl is also an automated SSL certificate generator, but it only produces self-signed certificates. So why not just accept self-signed certs?
- r1ch 12y agoUntil ad networks make a serious effort to enable https on their networks and CDNs, I can't run https on any of my sites. Mixed content security means no http ads and thus no revenue.