5 ms·
This is a great move and has inspired me to think of how I can do this for the sites I run. The problem I have is that I run forums which accept user generated
by buro9 11y ago
This is a great move and has inspired me to think of how I can do this for the sites I run.
The problem I have is that I run forums which accept user generated content, and the links in the content are then parsed and embeds are put in.
For example, YouTube links have the embedded video put below to the link.
YouTube support https, but a lot of smaller sites that offer really useful tools don't yet support https. An example is something like http://www.bikely.com http://www.bikely.com which does not support https at all, and yet the embedded maps are common enough on the cycling forums I run.
I cannot just proxy via a https domain as these sites usually have JavaScript that require permission to talk to their own domains.
I've decided to start emailing all of the 3rd parties to ask that they add https to their site.
Almost 40% of my traffic is now over https, and it's harder to increase that as every time I try to I receive support complaints about mixed-content warnings, missing content, etc.
If you also run a site that has embeds in user generated content, please consider emailing the 3rd parties and explaining why they should move to https.
There are only a few things holding back a lot of sites and it's no longer the cost of a cert and SSL termination:
1) Embedded widgets that are http only today
2) Advert widgets/scripts that are http only today
Those things hold the vast majority of news sites back too. I even checked the Guardian yesterday and no https available. The only news site that was https was The Verge, but I'm not sure tech news is really news.
- deleted 11y ago[deleted]
- hrrsn 11y agoReplacing embeds with plain hyperlinks seems like it would be better from a user privacy perspective.
- JoshTriplett 11y agoOr at the very least with iframes. If you run a forum and you're allowing directly embedded content, you're trusting that content not to break your security.
- richardwhiuk 11y agoI think iframes will result in a embedded content warning?
- justinph 11y agoYes, they do.
- JoshTriplett 11y agoYes, they will, but they're an improvement over script tags (which will also result in a mixed-content warning).
- buro9 11y agoI use Markdown for user content, this is passed through a Go library I wrote to strip out iframes, embeds, etc... https://github.com/microcosm-cc/bluemonday https://github.com/microcosm-cc/bluemonday and then as a post-processing task once I trust the content, I find the links that I know how to handle (YouTube, Bikely, etc) and embed third party content in iframes. This is basically a way to do the equivalent of Twitter cards, it respects the JavaScript and web security model, but does mean that the iframes contain http content on a page that is https Where I'm trying to get to is to have all iframes, etc be https
- JoshTriplett 11y ago> I find the links that I know how to handle (YouTube, Bikely, etc) and embed third party content in iframes. Ah, that makes sense. From your previous comment, I didn't realize you were recognizing and explicitly handling sites like Bikely.
- deanclatworthy 11y agoI'm not sure what forum software you run but the majority can be modified. The way I would approach this is to modify the output and replace all instances of supported embed URLs with https.
- sp332 11y agoBut that doesn't work for sites that don't support HTTPS. It would either break the embed by trying to connect over HTTPS anyways, or try to load a bunch of HTTP content into an HTTPS page which browsers will complain about.
- deanclatworthy 11y agoI think most of the major embed providers support https.
- buro9 11y agoI cited an example, http://www.bikely.com http://www.bikely.com is used by users on the forums I host and does NOT support https. Neither do several other embedded route/map providers like gpsies.com and so on.
- tacone 11y agoExactly. The problem is that News sites rely on advertising. Due to the general low technical quality of adv companies/companies' suppliers/customers etc you will find often find an image/flash/js served over plain HTTP or with a bad certificate. That single HTTP bit will immediately trigger the terroristic browser behaviours we learned to accept and love, including but not limited to: red signs, technical jargon pop ups, fully red pages with jargon disclaimers of all sorts and "getme outta here" buttons. Funnily enough, I remember reading a technical blog post written by Guardian devs themselves, citing this very problem.
- pixl97 11y agoThe browser isn't exactly wrong for triggering those 'terroristic' behaviors. If there is one single http bit being included and rendered on the https web page then the entire security of the page is rendered useless if there is a MITM attacker between you and the source. That single http bit can include whatever the attacker needs in javascript to redesign the page to steal content and provide tampered content.
- yeukhon 11y agonot just small tool, last.fm's artists avatar are only served over http and https is self-signed/not trusted.