3 ms·

Can someone explain why HTTPS is necessary for a webpage where I don't log in or submit any information? For example, take the xkcd homepage. Not only do I not

Can someone explain why HTTPS is necessary for a webpage where I don't log in or submit any information? For example, take the xkcd homepage. Not only do I not log into it, there's nowhere I _could_ log in. The only input is a search box (which seems to be disabled at the moment anyway). Is it really a security risk if my communication with xkcd's servers is unencrypted? (Yes, xkcd has a store and a forum, and I understand why you'd need HTTPS on those subdomains - but I don't see why the main domain needs it.) I agree with the parts of their plan to disable browser features that could be a security risk to non-HTTPS pages - that makes total sense. But it seems absurd to prevent static pages from using future CSS layout features just because they're not using HTTPS.

rogerbinns 11y ago
Intermediaries can (and already do) silently cause the content to be tracked, altered or otherwise modified against both your and the site owner's interests. How would you feel if they inserted javascript to mine bitcoins?
- peteretep 11y ago
  > How would you feel if they inserted javascript to mine bitcoins? I couldn't care less. JavaScript to DDoS GitHub, on the other hand...
MichaelGG 11y ago
> Can someone explain why HTTPS is necessary for a webpage where I don't log in or submit any information? What about a site giving out health info? No login there, but could have consequences if tampered with. Or recipes (same as health info in some cases). Or news (could make investors jump). Not that HTTPS fixes all of this, but there's no reason to think that a non-interactive or "static page can never benefit from security.
higherpurpose 11y ago
Because you can be served malware through non-secure connections (by state actors or local Starbucks hackers): https://citizenlab.org/2014/08/cat-video-and-the-death-of-clear-text/ https://citizenlab.org/2014/08/cat-video-and-the-death-of-cl...

rogerbinns 11y ago

Intermediaries can (and already do) silently cause the content to be tracked, altered or otherwise modified against both your and the site owner's interests. How would you feel if they inserted javascript to mine bitcoins?

peteretep 11y ago
> How would you feel if they inserted javascript to mine bitcoins? I couldn't care less. JavaScript to DDoS GitHub, on the other hand...

MichaelGG 11y ago

> Can someone explain why HTTPS is necessary for a webpage where I don't log in or submit any information? What about a site giving out health info? No login there, but could have consequences if tampered with. Or recipes (same as health info in some cases). Or news (could make investors jump). Not that HTTPS fixes all of this, but there's no reason to think that a non-interactive or "static page can never benefit from security.

higherpurpose 11y ago

Because you can be served malware through non-secure connections (by state actors or local Starbucks hackers): https://citizenlab.org/2014/08/cat-video-and-the-death-of-clear-text/ https://citizenlab.org/2014/08/cat-video-and-the-death-of-cl...