3 ms·
>However what triggered the whole article was that more and more websites become completely impossible to use in the absence of SSL even for anonymous data acce
by untitaker_ 11y ago
>However what triggered the whole article was that more and more websites become completely impossible to use in the absence of SSL even for anonymous data access.
How would you bootstrap a secure encrypted login for a user who was browsing the site without SSL? I agree with you that anonymous data access is often encrypted unnecessarily, but in practice deploying HTTPS is an all-or-nothing deal.
- the_mitsuhiko 11y ago> How would you bootstrap a secure encrypted login for a user who was browsing the site without SSL? If you have a website where users sign in you are pretty much left with SSL from the sign-in form on but you can move an indirection between the sign in and out so that a user has a chance to verify they are authenticating on the right site. Fundamentally there is no difference from the user's perspective for as long you are okay with moving the log-in box to a secure URL where the user can check the authentication.
- untitaker_ 11y agoI mean that while browsing unencrypted, the user can be phished away from the site quite easily.