Hacker News Reader

Comment by lakomen | Hacker News Reader

[flagged]

Does it matter? You're not giving the site any sensitive information.

Yes, it does. An MITM attacker can deliver malicious code to you which runs in the website context, and can exploit any bugs in your browser's javascript engine.

Sounds like you have a bigger problem if your browser isn't properly sandboxed.

ISPs previously did this. Not JS exploits, but they injected ads into HTTP web pages. Really popular ISPs, on the level of Comcast.

Sounds like FUD

Your ISP (or your router) can easily add their own JavaScript/HTML/ads on websites using http, it's likely that you are using a decent ISP that doesn't but is better if it's not even possible.

Public wifis are still a thing, many of them not well secured against Mitm attacks. Also compromised routers. So even if you trust your ISP (and their IT security and supply chain) there are still good reasons to want HTTPS everywhere

Yes it does. You seem to be living under a rock too asking that question. Here, let me Google that for you:

https://www.google.com/search?q=why+use+https

How hard is it, now that we have had free certs via letsencrypt and the certbot tool to automate vhost configuration to have encrypted and signed data transfer?

It's a matter of 2 minutes to add.

What excuse do you have to not use https?

I think you should re-evaluate how you speak to people online, it is unnecesarily hostile and I guarantee you wouldn't speak to me this way in real life.

Highly recommended that you read the Hacker News guidelines linked at the bottom of the page, especially the "In Comments" section.

https://news.ycombinator.com/newsguidelines.html

OP doesn't owe you an excuse for offering content for free through a technology you disapprove of.

I'm sure the lack of use of HTTPS is absolutely murdering Tom's viewcount.

have you been living under a rock

judging from how you speak to people that put a lot of effort into creating some very engaging content for free, you're the one that's been, and still is, living in a cave.

What would you expect to be stolen by MITMing the connection between you and a plaintext blog?

They could redirect the user to other website (eg a phishing one), I know it's unlikely but better if there is no chance of it happening.

Several major American ISPs actually did this. It was one reason for the big push to HTTPS everywhere.

Reply on news.ycombinator.com