Hacker News Reader

> if I'm not logged into Wikipedia, and simply searching and reading articles, why does that need to be served under HTTPS either?

Because we have already seen tampering that could really cause some issues. Injecting ads, snooping on search info to target advertising, things like censoring specific articles or specific topics.

Because of how global the internet is, regulation can't really solve many of it's issues (unless literally everyone can agree on the rules), so we need to solve them technically. Securing you to the server makes all of those things much more difficult.

>By forcing every site to go HTTPS not only increases the cost of ownership (in time, and optionally, cost) but also adds complexity for small site owners, and completely goes against the open web ideal.

Then let's solve those issues. Added complexity is not a reason to abandon TLS for most sites, it should be a goal to not only get TLS, but to make the process easier for the average joe to setup and run.

By starting to push in the direction of "TLS everywhere" we are encouraging more automatic and easy ways of maintaining this stuff (just look at how far let's encrypt has come in such a short time! How long until it's a GUI program that even my grandfather can use?).

> simply searching and reading articles

Encryption protects against an eavesdropper logging what you read.

> It should be down to the owner of the site if they want to add SSL

The owner of the site shouldn't also be able to force others to drop their protections against eavesdropping. There are two parties to each conversation.

> There's hardly any overhead involved if you add to the browsers page parsing routines

That only covers a small subset of threat models. Passwords and other credentials are not the only data that needs protection. Thanks to Lets Encrypt, enabling encryption has hardly any overhead. Most of the problems are outdated software and hosting services.

Encryption is important not only for personal safety, it's also needed to protect against threats like China's Great Cannon[1]. Choosing to say with plaintext is socially irresponsible because the decision about using encryption is also about providing ammunition for the Great Cannon.

[1] https://citizenlab.org/2015/04/chinas-great-cannon/

> Scaling that up - if I'm not logged into Wikipedia, and simply searching and reading articles, why does that need to be served under HTTPS either?

Because a malicious MITM could modify the content you are reading (and thus affect your perception of a subject). A bit of misinformation here and there can go a long way.

Targeting Wikipedia is different then personal static blog of John Doe. Wikipedia has resources for this, John doesn't - hence threatening the open web.

Conversely sites such as Carphone Warehouse who buy a certificate, would get advertised by Chrome to the uninitiated as "Secure". Despite woeful backend security: http://www.bbc.co.uk/news/uk-33835185.

That's not even the worst of it. Websites that use reverse proxies such as Cloudflare to give them the HTTPS for the first leg (visitor->Cloudflare) give no indication that the second leg (Cloudflare->origin) may be totally in the clear.

The UX is going to be tricky to get right.