And just yesterday I told someone to visit BBC when trying to connect to public wifi that requires a redirect to a login page first. Guess I'm going to have to find a new go-to http site now
Enabling Secure HTTP for BBC Online
11–20 of 63 posts
Re: Enabling Secure HTTP for BBC Online
#12> The CPU overhead of TLS encryption has historically been significant. We’ve done a lot of work behind the scenes to improve both the software and hardware layers to minimise the load impact of TLS whilst also improving security. I thought that it hasn't been significant overhead for a while now? related: https://www.maxcdn.com/blog/ssl-performance-myth/ https://istlsfastyet.com/
> Even a 2012 MacBook Air can sign an SSL key in only 6.1 milliseconds.
The BBC has to deal with machines much older and much less powerful than that.
Re: Enabling Secure HTTP for BBC Online
#13Despite such late upgrade to https, the site looks good, uses html5, works without Flash and even not accuses me of piracy for using adblocker.
Re: Enabling Secure HTTP for BBC Online
#14> HTTPS has been around since 1996 A blog post about spending several years updating to a protocol that's been around for 2 decades and has been standard for full sites for years. This makes me feel like anyone who has an account on BBC should be afraid of their security practices. Calling a plaintext password leak from BBC right now. EDIT: People are taking this comment more seriously than I intended. I don't actual…
Calling FUD on your comment. It hasn't been "standard on full sites for years", and still isn't now. Only recently with the 'HTTPS everywhere' move has the idea that public sites with no authentication should support HTTPS. And even now, that's not a universally supported opinion, because of its effect on caching. The BBC has used HTTPS on pages with forms that submit secure data, as has been the historic standard. M…
Can you point out some other major sites used by the general public which have spent the last few years without site-wide SSL to back up your claim?
Re: Enabling Secure HTTP for BBC Online
#15And just yesterday I told someone to visit BBC when trying to connect to public wifi that requires a redirect to a login page first. Guess I'm going to have to find a new go-to http site now
Perhaps zombocom? http://www.zombo.com/
Re: Enabling Secure HTTP for BBC Online
#16> HTTPS has been around since 1996 A blog post about spending several years updating to a protocol that's been around for 2 decades and has been standard for full sites for years. This makes me feel like anyone who has an account on BBC should be afraid of their security practices. Calling a plaintext password leak from BBC right now. EDIT: People are taking this comment more seriously than I intended. I don't actual…
Calling FUD on your comment. It hasn't been "standard on full sites for years", and still isn't now. Only recently with the 'HTTPS everywhere' move has the idea that public sites with no authentication should support HTTPS. And even now, that's not a universally supported opinion, because of its effect on caching. The BBC has used HTTPS on pages with forms that submit secure data, as has been the historic standard. M…
> It hasn't been "standard on full sites for years", and still isn't now.
I'd estimate about 75% of the time I'm on an HTTPS website.
> The BBC has used HTTPS on pages with forms that submit secure data, as has been the historic standard.
This is insecure as the HTTP page can redirect to a malicious HTTPS page from a different domain.
Re: Enabling Secure HTTP for BBC Online
#17Earlier quoted context omitted.
Calling FUD on your comment. It hasn't been "standard on full sites for years", and still isn't now. Only recently with the 'HTTPS everywhere' move has the idea that public sites with no authentication should support HTTPS. And even now, that's not a universally supported opinion, because of its effect on caching. The BBC has used HTTPS on pages with forms that submit secure data, as has been the historic standard. M…
Can you point out some other major sites used by the general public which have spent the last few years without site-wide SSL to back up your claim?
I can do better than that - I can give you a report published by Google in March 2016 which listed lots of them.
https://www.google.com/transparencyreport/https/grid/
For example, the following are all in the world's top 100 websites and none of them support any form of HTTPS. The link includes quite a few more.
* alibaba.com
* ask.com
* ask.fm
* baidu.com
* cnet.com
* cnn.com
* dailymail.co.uk
* ebay.com
* globo.com
* go.com
* goal.com
* goo.ne.jp
* imdb.com
* live.com
* mirror.co.uk
* naver.jp
* nytimes.com
* onet.pl
* pornhub.com
* telegraph.co.uk
* uol.com.br
* weibo.com
* wikia.com
* wikihow.com
* wp.pl
* yahoo.co.jp
* yelp.com
* youporn.com
Re: Enabling Secure HTTP for BBC Online
#18> Earlier in 2016, the Chromium development team decided to implement a change to Google Chrome, preventing access to certain in-browser features on ‘insecure’ (non-HTTPS) web pages. In practice, this meant that key features of certain products, such as the location-finding feature within the Homepage, Travel News and Weather sites, would stop working if we didn’t enable HTTPS for those services.
I think this shows how valuable it is to use incentives to get people to Do The Right Thing(tm). Perhaps more things should be changed to require HTTPS.
Re: Enabling Secure HTTP for BBC Online
#19And just yesterday I told someone to visit BBC when trying to connect to public wifi that requires a redirect to a login page first. Guess I'm going to have to find a new go-to http site now
Space-bar heater :)
ON a more serious note, I always use http://example.com. Being reserved and maintained by the IANA for documentation and testing, it's the most stable site I can think of.
Re: Enabling Secure HTTP for BBC Online
#20Apologies if I'm being naive, but how does it take 3 architects a whole year to upgrade a family of websites to HTTPS? The BBC are way behind the times here, although the article alludes to issues with suppliers.
The BBC's web infrastructure is a patchwork of disparate systems, run by separate product teams, on lots of different technology dating back potentially a couple of decades in some cases, with lots of third-party dependencies. Additionally, many of the original teams developing their websites are no longer with them, and as with most systems, documentation has no doubt suffered over the years.
For each individual product, they need to figure out what modifications it needs to become HTTPS-enabled (lots of links and identifiers are hard-coded to HTTP, and third-party CDNs might not support HTTPS by default), and update their testing procedures to ensure that it remains HTTPS-compatible, before they can enable HTTPS. Given that this is the BBC (a publicly-funded entity), they also have to ensure that everything continues to be fully supported on browsers going back to IE6, Firefox 3, and Safari 3 - with partial support for some browsers older than them.
In my opinion, a year is doing pretty well.