Hacker News Reader

Comment by unethical_ban | Hacker News Reader

The actions Mozilla proposes sound awful. I believe that a secure (from the NSA) Internet is the way forward. But this seems so goofy to me. There are legitimate reasons for a site not to be hosted on HTTPS.

  * It is a static site with no forms or logins  
  * It is non-critical info  
  * The site operator can't afford a certificate (Let's Encrypt is only one site...)

As you say: Color-code sites with a bit more granularity. Don't cripple the cleartext web.

View on HN

What part of this proposal made it seem like static sites with non-critical info would be "crippled" over HTTP?

Static sites or non-critical info! "Gradually phasing out access to browser features for non-secure websites, especially features that pose risks to users’ security and privacy" could affect sites that don't expose critical info.

All browsing behavior can be used to build a profile about someone, whether for advertising, surveillance, or whatever. There's a lot more information in the fact that person A visited pages 1-6 on unencrypted website B than one might realize. This reason alone should be enough for us to demand encryption (not necessarily via CA certificates) for any connection that isn't demonstrably local and unintercepted.

How does that go away? Most internet advertising/surveillance is performed by the actor with whom you're directly communicating, I think....

Regardless how static a site is attackers are free to inject any script code they wish in the HTML page on Http.

Reply on news.ycombinator.com