Why should my blog of static pages need to be served over HTTPS to avoid having Firefox slap a scary red icon next to it?
There's a parallel universe where ssh is plaintext, and only "sensitive commands", such as "sudo", are encrypted. In that universe though, plaintext HTTP doesn't exist and they're making fun of us.
One day, HTTPS may organically become the default for all websites, but pretending that it can happen over-night is crazy and that is what this change is basically expecting people to do.
For example, I host my personal sites and a bunch of my friends and friends' businesses' sites for free. Sites that otherwise wouldn't be online. I do it via the Rackspace Cloud Sites platform because it has better performance than typical 'shared' hosting. If I want an SSL certificate running on one of them, it's $20 per month per domain... in addition to the actual yearly cost for the certificate. I don't have that for sites I give away for free.
That's in addition to the hassle for the 3 days and multiple faxes and phone calls it takes for me to renew my businesses that do use SSL certs from reputable providers (as opposed to the $10-$20 a year providers that don't bother to even check who is buying the cert).
The SSL cert setup isn't terribly secure, is a big hassle, and costs a prohibitive amount of money for most smaller sites.
You're answering "why" instead of answering "why not" again. "Why should you lock your door if you don't have anything expensive?"
Plaintext HTTP should not exist, then we wouldn't be having this discussion. I wouldn't have to come up with elaborate scenarios where having HTTPS from the get go would have saved lives, and you wouldn't have to come up with crazy "but that'll never happen" retort to them.
Unfortunately, plaintext HTTP exists, so here we are, with me telling you that the pro-gay rights piece you wrote on your static blog contains keywords that make it be viewed as extremism/terrorism by Russia's automated monitoring systems and anyone reading it gets immediately added to a watchlist. Unfortunately, a few of your readers are from russia and six months later those readers join a political protest against the killing of kittens or something. Their government notices that and makes sure to "take action". And to think HTTPS could have avoided that.
Locks come standard on every door, they don't expire after a given time and every child knows how to use them. See how your comparison to acquiring, setting up and maintainning an SSL certificate is nonsensical?
> And to think HTTPS could have avoided that.
If the NSA tags people who look for info on TOR as extremists, an hypothetical state might tag people who use HTTPS. And to think that HTTP could have avoided that! I mean, if every argument is an hypothetical, anything is possible.
Thank you for reinforcing my point, I appreciate the help.
Define "sensitive".
If there is a network attack[0] then the metadata of who is viewing which pages on your blog is revealed. With TLS, only the client/server address pair is leaked.
IPv6 will bring back enough IP's to allow each site to be it's own IP, and no longer require SNI...
After a transition period, all plaintext protocols should be completely deprecated except for extremely special use, much like telnet was.
For example, let's say you wrote a blog post about fixing a configuration issue for touchpad issues on a ThinkPad X1 Carbon on Ubuntu 12.04. Imagine that a passive MitM saved the IP address of everybody who read that blog post in a database. Then, if an "interesting" person is known to be a ThinkPad X1 Carbon owner that uses Ubuntu 12.04. They can use that list of IP addresses of readers of that specific blog post to help narrow the search for the possible locations (via geo-IP) of that user.
Right now it is pretty easy to distinguish which webpage on your blog the reader is reading through traffic analysis, even when HTTPS is being used. But, people are working on things that make that traffic analysis more difficult.