Hacker News Reader

Comment by hk1337 | Hacker News Reader

I don't think anybody should go as all-in as the OP in the article but he might have some good points. Why does everything have to be https? Like, if I am writing a basic blog, with no forms, no CC payments, doesn't capture anything sensitive, why do I need an SSL certificate to appear as a valid site?

View on HN

It's about integrity, not confidentiality. Without HTTPS, anyone between you and the server can mess with the content you're receiving. It could be injecting ads, or make the website upside-down [1], or replace downloads with malicious links.

[1] https://pete.ex-parrot.com/upside-down-ternet.html

Because I want to read your words, not whatever other person's or machine's standing between your and my machine.

It's one of the key points the author takes an issue with. That PKI is not MITM resistant enough, in the ways they dream of. That they need to monitor the CT logs, and that not being a whole lot.

That's a niche problem to have though. Most random bloggers are not going to be targets of MITM that rewrites their posts. If that becomes a problem, then sure, add HTTPS.

You can read about the history of the non-nicheness of this problem in other comments. It also doesn't need targeting.

Because your website will sell me Viagra and tell me to buy cryptocurrency when I visit it on some public wifis. Your words are also obscured by ISPs telling me that my router needs replacing and that I've nearly used up my data cap.

You don't need TLS for your blog, though. Browsers will still connect to port 80 if you don't enable HTTPS.

Back when http was more popular my mobile provider injected popups with ads on every http page like nobodies business. And I couldn't switch to another, they all did that.

This isn't about theoretical MITM attack, it used to be widespread.

And there isn't any reason why it wouldn't spread again if http got more popular

Reply on news.ycombinator.com