Hacker News Reader

Comment by bowlich | Hacker News Reader

Because my statically generated blog really needs https.

This is really going to create an additional layer of inconvenience for people who just want to drop some html documents in an ftp folder and be done with it.

View on HN

>Because my statically generated blog really needs https.

So I was reading your blog and am particularly concerned about the crypto miner present on the page. Care to explain this to me? Hint: MITM due to insecure context and the miner isn't coming from you but as a user, I'm going to blame you because it happens on your insecure blog page.

Both my personal static site and my "literally only I can use it I've disabled user registration" file host use https. I can think of no good reason not to - to which people always link me that stupid anti-https n-gate article. The same site where the owner links to a Patreon account that I cannot verify is them and not a malicious actor looking to get donations from readers of the site. They also link to a Twitter account that may or may not be them.

Nobody's saying it does - including Chrome. The browser will simply (and correctly) show "Not Secure" in the address bar when next to the url viewing your blog. If a user doesn't have an expectation of security, they won't be bothered or perhaps even notice.

Which is great for users that understand what these security concerns are all about, like typical HN folk. But these people are probably aware of cyber security already, so not much gain here.

And people that _don't_ understand cyber security will have no context for what "not secure" means, and may needlessly avoid a variety of HTTP static-HTML sites, where these security issues aren't that great a concern.

Um, good? If people avoid your site because its not secure, maybe you should fix it?

What does it mean to fix a site that does not accept/process POST requests?

Start serving over https? Since when has encryption only mattered for POST?

Can you explain the benefit in other situations?

Preventing MitM attacks is the only thing I can think of.

But your static blog isn’t secure served over HTTP. And that’s fine if you choose it.

Oh no, someone's going to MITM my shitty blog posts. "Secure" is a word that only makes sense with context, and without that context it only serves to cause irrational panic. I wonder why Google's really doing this.

Yes. They literally will. ISPs have injected ads into pages delivered to their customers. Data integrity also comes from HTTPS too.

Boxing out ISPs is probably a large part of why they're doing it. Google believes traffic should be able to go directly from your computer to the server in question and then load up Adsense without any interference from your ISP injecting ads. They can do things for more than one reason, it's a good thing, but it also nullifies one of the few channels they don't have access to.

You may not care if bad actors inject crap into your web page, but I care, as may many of your readers.

This is not a theoretical vulnerability. Comcast routinely adds stuff to unencrypted web pages.

> I wonder why Google's really doing this.

You don't have to wonder all that hard given how publicly Google has discussed their stance on this. They have been using their leverage to try to force SSL usage for some time, including adversely affecting search rankings for sites that don't use it. They have clearly articulated many times they think SSL everywhere is important for the web, and they have the leverage in search/browser marketshare to try to make this a reality.

> https://security.googleblog.com/2014/08/https-as-ranking-sig...

The Google IO talk for Google's desire for "HTTPS everywhere"

> https://www.youtube.com/watch?v=cBhZ6S0PFCY&utm_source=wmx_b...

For what its worth, most metrics show a significant jump in SSL usage in 2016/17 following the announcement that it could adversely affect search rankings, although who knows if the two are related.

You'd be amazed at the amount of web sites which are not secured. E-commerce sites, corporate sites, classified sites, you name it. How unlikely would be to visit a news site through some "free" vpn service only to have most of the ads replaced with shady ones. I mean let's get realistic here, https while inconvenient will make the web a better place. And even if your site isn't secure most users won't even notice because they rarely ever watch the address bar. If they did there wouldn't be a bazillion of phising attacks out there.

It's not irrational. Remember the Great Cannon of China attack in 2015? That attack tool works by modifying the responses to insert code to attack the victim. If your shitty blog posts aren't over https, then they can be used to attack other people.

In a way, it's a little like a public health argument. You might not be worried about measles but you should still be vaccinated for the sake of the herd.

How is having a "not secure" label showing up on your not secure http html folder an inconvenience? I think it makes more sense to move to secure by default, with a large "not secure" label for the nondefault (non-https) sites. Better to be proactive with the labeling than relying on endusers having to remember to look for that little padlock now that letsencrypt hands out certificates for free in a super easy, automated fashion.

And what happens if my grandmother mitm your site to redirect to a fake login page. Internet security is everyone hosting on the internet's responsibility. You're doing a disservice to your users.

If the only advantage you can think of for sending traffic unencrypted is that it saves you a small amount of time, you're unlikely to find anyone who cares.

"I'm lazy, so I don't want to set up encryption on my website, but please don't tell my site visitors. They don't need to know"

Yes, plus it gives the feeling that https://chase-very-secure-sign-in-1024-bits-certificate.scam... is perfectly secure when it’s not.

Good education >> Browser gimmicks.

Good education doesn't scale. Browser "gimmicks" help people make better decisions when they don't have good education.

Also I get a huge red alert when I follow that link. Seems like chrome is doing a good job telling people it isn't secure.

On the contrary, the move is also to remove the padlock and "Secure" signs from such sites.

Reply on news.ycombinator.com