Earlier quoted context omitted.
If you visit any non-https site, then you leave a vector wide open for a MITM to perform numerous types of attacks. Not just against the unencrypted site you're visiting. They can launch phishing attacks or CSRF attacks or inject malware. If every site were https, then that would provide a huge boost to peoples privacy and security.
>If you visit any non-https site, then you leave a vector wide open for a MITM to perform numerous types of attacks. how?
US Senate website says use HTTP instead of HTTPS
91–100 of 129 posts
Re: US Senate website says use HTTP instead of HTTPS
#92Earlier quoted context omitted.
If you visit any non-https site, then you leave a vector wide open for a MITM to perform numerous types of attacks. Not just against the unencrypted site you're visiting. They can launch phishing attacks or CSRF attacks or inject malware. If every site were https, then that would provide a huge boost to peoples privacy and security.
>If you visit any non-https site, then you leave a vector wide open for a MITM to perform numerous types of attacks. how?
Re: US Senate website says use HTTP instead of HTTPS
#93Excuse the ignorance, but what's the problem if it's purely an informational read only site? There's no logins, prompts, messaging that can be exploited. What's the problem of it being unencrypted? Don't get me wrong I'm all for https when there's user information to be protected back and forth, I just don't see the applicability for it here.
You could do a MITM attack and change a Senator's email address to spy@russia.com. Ok it's a long shot, but not being able to serve your site over https is also a flag that your technical configuration has problems.
Re: US Senate website says use HTTP instead of HTTPS
#94Earlier quoted context omitted.
I can see the http version in Japan.
I am in Tokyo and both versions are blocked for me.
Re: US Senate website says use HTTP instead of HTTPS
#95Can someone tell me why this might have been required? What are the situations which might prompt a developer to make their users use http instead of https?
As they go through compatibility testing, someone finds a problem. Maybe that's a bunch of legacy HTML which triggers mixed-content warnings, maybe that's a problem with some creaky old legacy application which expects HTTP and doesn't follow redirects or chokes on modern cipher suites, etc.
Since they can no longer say that switching won't break anything, someone pauses the project until they can fix the problems. Maybe someone suggests using a rewriting proxy to fix it but the people who own the server it'd need to run on are worried about performance/security. Maybe the legacy app is something licensed from a vendor who wants $$$ for a major upgrade rather than just making this one change. Maybe that requires a change in next year's budget because they've already allocated all of the money they're legally allowed to spend on that class of work.
It could be as simple as budget: they're using Akamai and it's likely that the contract they originally signed didn't include HTTPS, and at least in the past adding it was a non-trivial price increase. I could easily believe that this could be as simple as either a test pending a new contract or that a section of the website (or a subdomain) uses HTTPS but they added a general redirect to avoid paying the higher HTTPS rates for traffic which doesn't require it.
Re: US Senate website says use HTTP instead of HTTPS
#96I'd forgotten how fast everything loads if you use http instead of https. It's quite refreshing to not have that initial half-second or so lag that you get when loading an https page. Hopefully we'll make back some of the difference once http/2 is more widespread.
HN, for example, loads in less than half a second, due to using a CDN (i.e. Cloudflare).
With CDNs, the RTTs are small enough to not matter.
Re: US Senate website says use HTTP instead of HTTPS
#97Excuse the ignorance, but what's the problem if it's purely an informational read only site? There's no logins, prompts, messaging that can be exploited. What's the problem of it being unencrypted? Don't get me wrong I'm all for https when there's user information to be protected back and forth, I just don't see the applicability for it here.
- Nearly every "informational only" website will end up with feature creep moving it out of that - Simply not having SSL setup is one thing. But the linked page has, not only a valid SSL certificate, but someone went through the awful process of acquiring an EV certificate. To go through that, and then choose to not use it, boggles the mind
Re: US Senate website says use HTTP instead of HTTPS
#98Earlier quoted context omitted.
>If you visit any non-https site, then you leave a vector wide open for a MITM to perform numerous types of attacks. how?
it's fairly common for an ISP to inject popups into web traffic (or redirect your dns)
Re: US Senate website says use HTTP instead of HTTPS
#99Earlier quoted context omitted.
You mean that super costly 1KB in front of a request that pulls extra megabyte of data on a typical website? I really hope you missed a /s
I can save about 30% of traffic by optimizing content via HTTP. Can't do that with HTTPS without MITM or similar questionable practices breaking the purpose of HTTPS. While you're sitting on a 100+ Mbps DSL, somebody in the middle of Africa is struggling on an ISDN-like link.