Hacker News Reader

Comment by userbinator | Hacker News Reader

One of my biggest concerns is that the many "Not Secure" websites out there, likely older ones, will get ostracised as a result of this type of change. I don't think that's necessarily a good thing, because that's where I've found the most informative and interesting content. You can imagine in the future, users coming across some site that actually has good information, but being scared away by the "Not Secure" and instead going to some vapid ad-filled "modern" site with very little in the way of detailed content, just because it happens to be using HTTPS.

View on HN

I totally agree with this.

Sites that do financial transactions, or require user logons or user submissions (forums, comments etc.) need to be SSL, most others don't need to be secure at all. If I am reading a random blog by Joe, and he doesn't have a comments section, why does the site need to be in HTTPS?

Scaling that up - if I'm not logged into Wikipedia, and simply searching and reading articles, why does that need to be served under HTTPS either?

By forcing every site to go HTTPS not only increases the cost of ownership (in time, and optionally, cost) but also adds complexity for small site owners, and completely goes against the open web ideal.

It should be down to the owner of the site if they want to add SSL, those that don't and fulfil the criteria I've outlined, should not be penalised for it.

There's hardly any overhead involved if you add to the browsers page parsing routines a function to identify input fields, and mark a warning on the address bar accordingly if the site is not secure.

Blanket warning on all non-HTTP sites is just lazy.

> if I'm not logged into Wikipedia, and simply searching and reading articles, why does that need to be served under HTTPS either?

Because we have already seen tampering that could really cause some issues. Injecting ads, snooping on search info to target advertising, things like censoring specific articles or specific topics.

Because of how global the internet is, regulation can't really solve many of it's issues (unless literally everyone can agree on the rules), so we need to solve them technically. Securing you to the server makes all of those things much more difficult.

>By forcing every site to go HTTPS not only increases the cost of ownership (in time, and optionally, cost) but also adds complexity for small site owners, and completely goes against the open web ideal.

Then let's solve those issues. Added complexity is not a reason to abandon TLS for most sites, it should be a goal to not only get TLS, but to make the process easier for the average joe to setup and run.

By starting to push in the direction of "TLS everywhere" we are encouraging more automatic and easy ways of maintaining this stuff (just look at how far let's encrypt has come in such a short time! How long until it's a GUI program that even my grandfather can use?).

> simply searching and reading articles

Encryption protects against an eavesdropper logging what you read.

> It should be down to the owner of the site if they want to add SSL

The owner of the site shouldn't also be able to force others to drop their protections against eavesdropping. There are two parties to each conversation.

> There's hardly any overhead involved if you add to the browsers page parsing routines

That only covers a small subset of threat models. Passwords and other credentials are not the only data that needs protection. Thanks to Lets Encrypt, enabling encryption has hardly any overhead. Most of the problems are outdated software and hosting services.

Encryption is important not only for personal safety, it's also needed to protect against threats like China's Great Cannon[1]. Choosing to say with plaintext is socially irresponsible because the decision about using encryption is also about providing ammunition for the Great Cannon.

[1] https://citizenlab.org/2015/04/chinas-great-cannon/

> Scaling that up - if I'm not logged into Wikipedia, and simply searching and reading articles, why does that need to be served under HTTPS either?

Because a malicious MITM could modify the content you are reading (and thus affect your perception of a subject). A bit of misinformation here and there can go a long way.

Targeting Wikipedia is different then personal static blog of John Doe. Wikipedia has resources for this, John doesn't - hence threatening the open web.

Conversely sites such as Carphone Warehouse who buy a certificate, would get advertised by Chrome to the uninitiated as "Secure". Despite woeful backend security: http://www.bbc.co.uk/news/uk-33835185.

That's not even the worst of it. Websites that use reverse proxies such as Cloudflare to give them the HTTPS for the first leg (visitor->Cloudflare) give no indication that the second leg (Cloudflare->origin) may be totally in the clear.

The UX is going to be tricky to get right.

Reply on news.ycombinator.com