24

Is there any excuse for NOT having a HTTPS connection nowadays?

My university has so many unprotected subdomains that we're supposed to use and LOGIN ON that are not protected. Although these login forms are https protected the rest is not and seems sketchy.

Comments
  • 5
    The only excuse is neverssl.com
  • 8
    Recommended for all the "but my site doesn't need https" people:

    https://doesmysiteneedhttps.com/
  • 4
    @Fast-Nop Ironically the certificate of the Dutch version of that website has expired

    But thanks for mentioning it!
  • 1
    @alexbrooklyn what Dutch version?
  • 2
  • 1
    @alexbrooklyn oh, their LE cert expired 2 weeks ago. Looks like they botched up their auto renewal. But the redirect seems to be selective, probably geo-IP. I don't get redirected.
  • 2
    @Fast-Nop I emailed the person at the bottom of the page about it, hopefully it will be fixed soon :D
  • 1
    >Because cert maintenance is hard and we don’t want to deal with it.

    You asked for an excuse, here is one I’ve heard.
  • 2
    @bkwilliams I just wanted to say that it isn't hard because LE has automatic renewal, but I guess that argument went out of the window. ;-)

    However, good hosting providers just slap an LE certificate on a domain automatically even on shared hosting, and for free, so that's no work at all.
  • 1
    @Fast-Nop my org self hosts, uses software to generate certs (how it’s not self signed, I’m not sure), then the CMDB opens a Service Request when the cert nears expiration (if the date was entered into the CMDB correctly), then the cert is manually setup on the box. We have cert failures almost weekly because someone failed at that step. Yes I’ve told them about https://github.com/Netflix/lemur but it’s not my team so I can’t drive it further.
  • 1
    @bkwilliams yeah, having a workflow with a lot of manual steps instead of automating makes it likely that someone screws up. It's not an argument against https, but against manual workflows.
  • 0
    Why do you need HTTPS ?
  • 1
    @Nanos see the second comment in this thread. There is a link that you can click and read.
  • 0
    @Fast-Nop

    I was hoping for a simple no-nonsense answer I could digest whilst drinking a cup of tea. :-)

    Something perhaps, realistically practical.

    Reminds me of recycling, which we must do to save the planet..

    So I can't just throw my apple core into the garden then like always ?

    But what if I put it in the kitchen recycling bin instead of the garden one, will I get fined, will the apple police find out..
  • 1
    @Fast-Nop True, but in many cases people equate a workflow with the tech itself. Like the meme of the kid who sticks a stick into his own bicycle wheel and blames something else.
  • 4
    No, there are no valid reasons for that. Even if you provide plain read-only html to users, mitm could replace your inner hrefs with smth malicious. A tiny bit of phishing effort et voila - your users are pwned. Its bad for business. Its bad for your image. And it's plain and simple irresponsible
  • 2
    @netikras that MITM does happen in South-East Asia and the US with provider injected ads. Not the hosting provider, but the end user provider.

    Google made https a ranking signal in search, somewhat abusing their monopoly, but this time actually for the public good.
  • 0
    @netikras

    So only needed if you have a site with login requirements ?
  • 2
  • 3
    @Nanos is my English THAT bad?
  • 3
    What a coincidence! I was setting up the SSL certificate just minutes ago before I saw this rant, now all my websites are protected by 4096 bits encryption, isn't that great? I don't think such strength is necessary, but 4096 bits sounds much better than 2048 bits :D.
  • 2
  • 0
    Not all NEED a cert (if there’s no form data then sure why not), but for the lack of effort needed these days to add a cert, why not spend 5-10 minutes adding one. Some hosts even generate LE certs for you and auto renew them.
  • 1
    @netikras

    I don't understand the subject. :-)

    Looking for the Dummy's guide rule of thumb version, which explains most of the practical aspects in about 5 lines of text.

    Then I can get some idea of when I need to worry about that kind of thing in my next website project.
  • 1
    Don't mind me. Just passing through.
  • 1
    @Nanos Got cha. Well I am no official guide nor can I give any refs, but from my point of view anything facing public internet (or in fact - anything facing environment you cannot control/are likely to lose control of) should have ssl enabled. SSL does not have to be configured for your app -- it could be on WAF (at least that's what I mostly see). In that case all application's communications in inner LAN/inner infra are non-encrypted. In an event of security breach resulting in villain accessing your LAN, all application communications could be potentially leaked, so if you only terminate ssl on WAF make sure to protect your NW infra. Take into consideration that other apps in the same infra could get hacked as well, which could also result in your whole LAN being compromised.

    The drawback of SSL is that it's quite costly (performance-wise). But that should never mean that you don't need it where risks are high - internet-facing/HI-risk comms.
  • 0
    @netikras it isn't costly because modern CPUs support quite some needed instructions. I remember Google reporting something like 1-2% increased server load.

    The initial handshake costs one roundtrip more, that's nasty especially on mobile. BUT you get http/2 in return, which is only supported via https, and that makes more than up for the handshake.
  • 1
    @Fast-Nop the handshake is what I had in mind :) bcz it means additional nw traffic, additional tcp payloads. While a plain-text exchange means 2 data packages [lets ignore chunking]. Ssl handshake at least doubles that [do not remember the whole handshake by heart, but cert xchange, symm key exchange,...].
  • 0
    @netikras the traffic is irrelevant with the average website size these days, it's the latency - but that is addressed by http/2 where you need fewer TCP connections.
  • 0
    > the latency

    I'm reminded of a site I use, or I should say, try to use.. where it takes several seconds to send your username and password (Automated..), which if you aren't using your internet for anything else, just arrives in time before their site times out. (For security reasons..)

    But as soon as you are using your internet for anything else, wham, it takes too long, you time out !

    Grrrrrr !!!!

    Super annoying and they won't change the timeout !

    So have to find some working solution that works for everyone, client side only..

    If such a solution exists..
  • 0
    Why would I want https for a static site? It's just unnecessary overhead.
  • 0
  • 0
    @alexbrooklyn none of those points matter for static sites.

    Furthermore, some of the points are flat out misleading/wrong.
  • 0
    @toriyaki Spoofing of links and/or text can still happen 🤔

    Weird, the Dutch version of that site does mention it
  • 0
    @alexbrooklyn sure. But I'm worried about that as much as I worry about someone coming into my bedroom and attacking my computer: it's such a low risk, that it's a non issue.

    The overhead of https is too much right now. Dealing with renewals, properly configuring DNS, handling redirects, etc. Yes, those are "easy" steps to address, but it's extra steps nonetheless for no benefit. And those are just the most common issues.

    What if you want to setup a caching proxy? You need to roll out a root certificate. Again, unnecessary IT complexity. Extra points of failure.

    It makes no sense for simple static sites.
Your Job Suck?
Get a Better Job
Add Comment