Hacker News Reader

Comment by sansidentity | Hacker News Reader

Hypothetical. If I run a website for a small town public library that only serves information, ie no user accounts and no logins on our domain, is there a valid reason for me to go through the process of https and certificates? Plus I'm on a shared host. I briefly looked at the install doc on letsencypt and while it's clear it's easier than it used to be I am uncertain my shell access will give me the necessary permissions to even accomplish it without upgrading to something thing like a vps or administering my own vm with a cloud provider. Which is honestly something I am less than interested in doing if I can help it. Keeping a Web server secure is seems brutal to me.

View on HN

>If I run a website for a small town public library that only serves information, ie no user accounts and no logins on our domain, is there a valid reason for me to go through the process of https and certificates?

Absolutely. The privacy of library searches has long been viewed as one of the archetypal examples of why privacy matters. A user's ISP shouldn't be able to learn what sort of books, movies, and music a library patron is interested in. And that's before we get into matters like injection of malicious content by local miscreants at your favorite cafe, or ads by mobile networks. Fundamentally, it's an issue of your users being the ones deciding what they do and do not care about being secure, and security being the default (could you imagine the emotional hurdle someone who has a real need for their privacy when using the library website would have to go through to explicitly ask for it?). The Library Freedom Project, who has been in the news a lot as of late, was in part started to push the use of SSL in all libraries, even if you "don't need it."

https://libraryfreedomproject.org/ourwork/digitalprivacypled...

https://github.com/EbookFoundation/library-privacy-pledge/wi...

Encrypting sensitive user data is only one advantage of TLS. Without TLS, every single network hop between you and your client could modify your site. This could mean altering the content, adding ads or even malware. Some large ISPs have done so in the past. Furthermore, browsers vendors have decided that HTTPS is the way to go forward and will gradually mark HTTP-only sites as unsafe. New browser APIs might only be available in secure contexts.

You might be interested in this list of web hosts that support Let's Encrypt[1]. Generally speaking, your hoster should be able to provide a one-click interface for obtaining and installing a certificate for you, and odds are most hosts will eventually do so free of charge once HTTPS becomes mandatory.

[1]: https://github.com/letsencrypt/letsencrypt/wiki/Web-Hosting-...

Historically library usage has been surveilled, so I would say that making passive surveillance of your users more difficult is a 'valid reason' for going through the trouble.

You don't need logins/user accounts for your users to be identified. IP is sufficient in many cases, and browser fingerprint pretty much covers the other cases.

Also, if the website ever has need to become more complex, it will be easier and less error prone not to have to throw 'figure out how to implement TLS' on the pile of tasks.

Also, if permissions are the primary concern, might I recommend moving to a host that does SSL/TLS for you? Webhosts have come a long way in the last few years. Moving to a nicer one may actually save you effort in the long run.

Yes, there are many reasons to deploy TLS everywhere, and everyone should be working towards it for these reasons:

- Increased resistance to surveillance. Instead of seeing the pages/information that a client downloads from your server, state actors, ISPs, local attackers, and anyone else listening only learn that the client downloaded some bytes from your server.

- Mitigation of man-in-the-middle and man-on-the-side attacks against your website. These can be as simple as someone attacking a local open Wi-Fi access point to sophisticated attacks like the Chinese DDoS against GitHub and the NSA's QUANTUM INSERT. Potential attacks range from replacing/rewriting information to attacking client machines with browser exploits.

- Better SEO rankings, Google weighs HTTPS sites higher than their equivalent insecure plaintext.

If you need a shared host that supports HTTPS, take a look at DreamHost, they have a free one-click Let's Encrypt integration.

I pay $5/month for my shared hosting for 100GB disk space and unlimited bandwidth but it doesn't support HTTPS...

Sorry to hear that. HTTPS (via SNI and user-uploaded certificate) doesn't cost the hosting provider anything to support, so it seems like yours is just behind the times.

Absolutely. Not only is privacy important for your users (a list of what books someone has read being available to a user's ISP or a government is a violation of human rights), but TLS also secures your users from local network attacks (injecting malware into pages, or otherwise changing what information they see).

In the case of library you would want to protect users privacy for searching books. I do not think it is possible to switch to https on shared hosting without explicit action from the provider. For minimal administration, a cloud provider will work best. Check out AWS since they also offer free certificates.

while I agree with the importance of TLS and SSL for everyone , I do recommend buying a SSL straightup (about 8$ a year) and not going through the commandline setup unless you are comfortable. Most hosting services (especially the cpanel variety) just let you upload a certificate that you have bought.

It is probably more important that you do TLS/SSL than not do it because you are uncomfortable with Letsencrypt setup

here's the one I buy - https://www.ssls.com/ssl-certificates/geotrust-rapidssl

If the library site serves over plain http, it is fairly easy to snoop on the visitors activity. So one could find out which kind of books certain visitors were looking for. That could easily reveal secrets about said visitors.

If we are not just being hypothetical, a simple solution for you could be to register with cloudflare and run your site behind that. They will give you a free ssl certificate. This isn't as secure as running your own, since the connection between cloudflare and your server is in plain http, but it's a lot better. As an added bonus, you get a free caching layer in front of your site, which might be a good thing if you're on a small shared host.

I think Google penalizes non-https sites, so that's one reason.

Reply on news.ycombinator.com