Hacker News Reader

Comment by jacquesm | Hacker News Reader

> I'll again state that this is why I feel so strongly that Google Analytics should be updated to be HTTPS by default[1]. If you hit a non-HTTP site, you're leaking all the information you would send to Google Analytics to anyone that's listening

I fully agree with you but one small little issue here, wouldn't that violate the 'everything over https or nothing over https' rule for what's displayed on a page? In other words, wouldn't your browser balk at this if it were implemented?

Mixed http/https is frowned upon, and rightly so!

View on HN

Browsers tend to only complain if doing so breaks security, such as using Javascript from a HTTP source on a HTTPS page: the JS could be swapped out by a man-in-the-middle. If you use or communicate using HTTPS on a HTTP page, there's no real issues.

You can actually force Google Analytics to use HTTPS on a HTTP page[1] with _gaq.push(['_gat._forceSSL']) but it's not the default. If it's not the default, it's not going to be used heavily across the hundreds of thousands of pages using Google Analytics. Privacy death by a thousand cuts.

[1]: https://developers.google.com/analytics/devguides/collection...

That's something that might be fixable with a user-script or a browser plug-in?

Maybe something for the likes of ghostery or adblock to implement?

Generally, however, the problem is concern over leaking sensitive data to insecure connections (e.g. load an HTTPS URL but your HTTP referer header on all your insecure HTTP requests tells people your URL).

I don't see any issue with loading an HTTP site and then making an HTTPS request to Google Analytics. It's better to secure part of an insecure page than to leak part of a secure one.

mixed content warnings only appear if http content is included on an https page

Ah ok neat, I got bitten by that once in the past, did not realize that the other way around is fine. Now that I think about it that's kind of logical because you can't really give more away than you are suggesting to the user, only less. Thank you.

Reply on news.ycombinator.com