Haha, here's what I got on the first page load:
string(240) "https://ssl.bbc.co.uk/dna/api/comments/CommentsService.svc/V... string(40) "Error in cURL request: SSL connect error"
Enabling Secure HTTP for BBC Online
21–30 of 63 posts
Re: Enabling Secure HTTP for BBC Online
#22Earlier quoted context omitted.
Calling FUD on your comment. It hasn't been "standard on full sites for years", and still isn't now. Only recently with the 'HTTPS everywhere' move has the idea that public sites with no authentication should support HTTPS. And even now, that's not a universally supported opinion, because of its effect on caching. The BBC has used HTTPS on pages with forms that submit secure data, as has been the historic standard. M…
> It hasn't been "standard on full sites for years", and still isn't now. I'd estimate about 75% of the time I'm on an HTTPS website. > The BBC has used HTTPS on pages with forms that submit secure data, as has been the historic standard. This is insecure as the HTTP page can redirect to a malicious HTTPS page from a different domain.
I agree with the need for the BBC to do this. But I disagree with the OP's suggestion that, just because it took them until now to finish doing it, that I should be "afraid of their security practices".
Re: Enabling Secure HTTP for BBC Online
#23Apologies if I'm being naive, but how does it take 3 architects a whole year to upgrade a family of websites to HTTPS? The BBC are way behind the times here, although the article alludes to issues with suppliers.
It just took me three hours yesterday to secure a single Wordpress install. Three hours is a lot less than a year, but on the other hand it's longer than the 10 minutes I was expecting.
Re: Enabling Secure HTTP for BBC Online
#24And just yesterday I told someone to visit BBC when trying to connect to public wifi that requires a redirect to a login page first. Guess I'm going to have to find a new go-to http site now
http://something.com
or use what Google does when Chrome notifies you of a login gateway to public wifi: http://www.gstatic.com/generate_204
Re: Enabling Secure HTTP for BBC Online
#25> The CPU overhead of TLS encryption has historically been significant. We’ve done a lot of work behind the scenes to improve both the software and hardware layers to minimise the load impact of TLS whilst also improving security. I thought that it hasn't been significant overhead for a while now? related: https://www.maxcdn.com/blog/ssl-performance-myth/ https://istlsfastyet.com/
> Even a 2012 MacBook Air can sign an SSL key in only 6.1 milliseconds. The BBC has to deal with machines much older and much less powerful than that.
Every TLS speed concern I've heard has been about the server speed, not the client speed.
The servers shouldn't be running on old MacBook airs.
Re: Enabling Secure HTTP for BBC Online
#26> There are always practical limitations to site-wide technical changes, and HTTPS Everywhere is no different. Sites and content we consider ‘archival’ that involve no signing in or personalisation, such as the News Online archive on news.bbc.co.uk, will remain HTTP-only. This is due to the cost we’d incur processing tens of millions of old files to rewrite internal links to HTTPS when balanced against the benefit.
Not to be snarky, but haven't people written tools to help with this? This seems like a common issue. I mean, there's `sed` and similar tools, obviously, but something that could go, validate that the link works over https://, and update it. I don't see why that would need to be some monumental amount of work.
HTTPS is more than just privacy. See https://certsimple.com/blog/ssl-why-do-i-need-it and https://www.troyhunt.com/ssl-is-not-about-encryption/
Re: Enabling Secure HTTP for BBC Online
#27Good on BBC for coming right out and talking about their plans in public. Love reading this stuff!
Re: Enabling Secure HTTP for BBC Online
#28And just yesterday I told someone to visit BBC when trying to connect to public wifi that requires a redirect to a login page first. Guess I'm going to have to find a new go-to http site now
Re: Enabling Secure HTTP for BBC Online
#29Earlier quoted context omitted.
Calling FUD on your comment. It hasn't been "standard on full sites for years", and still isn't now. Only recently with the 'HTTPS everywhere' move has the idea that public sites with no authentication should support HTTPS. And even now, that's not a universally supported opinion, because of its effect on caching. The BBC has used HTTPS on pages with forms that submit secure data, as has been the historic standard. M…
Can you point out some other major sites used by the general public which have spent the last few years without site-wide SSL to back up your claim?
Washington Post. Buzzfeed. The Guardian.
New York Times still dosent have HTTPs.
Re: Enabling Secure HTTP for BBC Online
#30They enabled Secure HTTP don't forget. Not the insecure kind a lot of people might be thinking about here.