This is one of the few websites that don’t force you to use https even though it does have it! Impressive.
In the spirit of keeping things open and without a user account, I’d recommend setting up some jitsi [0] conference rooms that don’t require an account.
That’s bad, not good. Cleartext HTTP is a nice idea for an ideal world, but that’s not the world we are in: it’s demonstrably a vector for abuse, both passive and active. Save for a very few specific use cases (captive portal detector being the main one), it is irresponsible to support cleartext HTTP for any purpose but redirecting to HTTPS, preferably with a Strict-Transport-Security header so that that particular user agent skips straight to HTTPS forever after.
With that said, implementing security is a trade-off between your time and risk tolerance.
And that’s just the active. The passive is pervasive too, and is an attack (RFC 7258). And so I use the term “irresponsible” of anyone running any web service except for a very few specific purposes over cleartext HTTP.
There are reasons why we’ve shifted from cleartext to TLS for everything, not just for things conveying sensitive data.
I wonder if more malicious code is served from questionable ads on HTTPS sites than from ISP MITM injections into HTTP sites.
ⓐ With a suitable HSTS and max-age header, it’s roughly only the first time you access the site at all that you’ll go via HTTP;
ⓑ Anyone can submit their site to the HSTS Preload list <https://hstspreload.org>, which solves the problem completely for a particular site (including subdomains);
ⓒ It only applies to people typing in the URL manually: if your users come from a link from another site, that link should be HTTPS.
This final point is really the key to it all, and the place where I wish browsers would hurry up: they should be shifting to interpreting URLs typed into the address bar with no scheme as https:, not http:. There will certainly be some rough edges that need to be caught with it, and you might want to set IP addresses and a small number of names to default to HTTP, but even without that, Firefox’s HTTPS-Only Mode has all the required ingredients: if I type “neverssl.com” into my address bar, it pops up the about:httpsonlyerror page, “HTTPS-Only Mode Alert / Secure Site Not Available” with explanatory text and buttons “Continue to HTTP Site” and “Go Back”. They could do something like that specifically for typed URLs. (You might think “just downgrade automatically”, but that’s an attack vector—they can just block port 443—where requiring manual user intervention with a mildly scary warning mitigates it somewhat.)
The default really should be HTTPS by now. A little while after browsers all finally flip that specific thing over, I think we could collectively shut down port 80 for good, because no clients will ever try it any more.
Hope to see you at the freewrite.