Hacker News Reader

Comment by viraptor | Hacker News Reader

I realize this site is referring to password storage but it is itself a plaintext offender in that it doesn't support https.

All of the areas where you can actually submit data or login (comments, submit a site) are in https iframes. I'd agree that there are benefits for read-only sites using https, but it's not quite as serious.

it's mostly pointless to have an https iframe on an http site, as you won't know if the page is intercepted and the iframe is replaced

That's a good point. I only really deal with https-enabled sites any more - hadn't even thought of that.

Why does everything need to be https? Are you worried someone might find out what kinda lols your into?

https://https.cio.gov/everything/

Privacy is beneficial in itself, but also: > protecting less sensitive sites strengthens the protections of more sensitive sites

Any site that can be MITMed is a site that can be used to gather personal information and escalate from there. Especially seeing as most people reuse passwords like crazy.

Yes, everything does need to be HTTPS. If not for user privacy then for response integrity - to be sure the response hasn't been MITMed.

You might think most sites are innocuous, but it depends on where you live. I could see this site getting classified as "hacking/encryption-related" by something like sonicwall's firewall (HN too). What if your government tasks your ISP to round up all those trying to bypass state firewalls? Heck I live in a western country where our government is misguidedly angling to ban encryption. For the minimal effort involved, I believe all sites should be https.

The same reason the pharmacy puts your order into a brown paper bag even though you only bought some cough drops: That it provides cover for the next customer, who's buying hemorrhoid cream or whatever. If you only encrypt the sensitive stuff then encryption flags your stuff as sensitive.

Reply on news.ycombinator.com