Comment by johndoe4589 | Hacker News Reader

Comment by johndoe4589 | Hacker News Reader

Parent Full thread

You're absolutely right. I'm surprised nobody here seems to care. I guess HN is popular with techies who have root access on their servers, or people who run commercial sites.

What happened to the hobby / non profit apps, blogs and forums that fill 90% of the web and my bookmarks? All of them have a login form somewhere. Tons of people already use secondary emails or throwaway emails, but these site owners now have to pay for SSL or have to upgrade their shared hosting to "business" or the like to get SSL included, or pay extra fees to install SSL.

If all they do is look for a password field that means pretty much any phpBB or wordpress blog out there is defacto "insecure" and the owners of those sites now need to find a way to get SSL on their (most likely)shared hosting. Mine is not free at all, it requires "installation" fees, plus "dedicated Ip" so in the end it cost near as much as just buying their SSL package.

At this point though it's very unclear how Google will find those "insecure" password fields. Does it honer the no-follow? Because last time I heard it's not useful to get a login form page indexed anyway.

> I'm surprised nobody here seems to care.

I'm going to get skewered alive for saying this, and I do believe their intentions were noble, but I honestly think Let's Encrypt has done a lot more harm than good.

It's completely deflated the opposition to the CA racket, but not given a comprehensive alternative.

There are servers that can't run certbot for a variety of reasons (including administrator policies that people running the webservers can't control.) The 90-day expiration is the most arduous of any CAs out there by far. Not only are there no wildcards, but there are strict limits on the number of subdomains you can register per week.

And if you don't like it ... too bad. There are zero free alternatives.

Most of us are hackers and can work around these limitations, but not everyone can. You can't expect most people to set up certbot, let alone write their own version. You can't expect them to build some system that automatically batches and registers new subdomains and maintains all those certificates.

> I guess HN is popular with techies who have root access on their servers

That's a lot of it as well. I'd go so far as to say the majority of internet sites out there (by number, not by traffic volume) are little commodity hosting firms that give you a web GUI version of an FTP client, and maybe if you're lucky charge you $10-20 a month for SSL as a checkbox feature in the payment options.

> At this point though it's very unclear how Google will find those "insecure" password fields.

It will probably just look for <input type=password> and if that exists, show the "Not Secure" message.

Reply on news.ycombinator.com