51–60 of 63 posts
And just yesterday I told someone to visit BBC when trying to connect to public wifi that requires a redirect to a login page first. Guess I'm going to have to find a new go-to http site now
Earlier quoted context omitted.
Washington Post. Buzzfeed. The Guardian. New York Times still dosent have HTTPs.
Their traffic is too high for them to afford it (and probably wouldn't outweigh the SEO uplift)
Instead, the burdens are on testing and developing the migration. For example, they'd have to inventory and edit everywhere they use http:// (hardcoding the scheme in your front-end code) instead of //. Furthermore they have to support third-party ad networks deliver active scripts (like javascript) over HTTP. Having HTTP while on HTTPS will create mixed content warning and for active contents browsers will block these violations immediately, thus breaking the website.
To me, the decision of not migrating to HTTPS because of infrastructure capacity is always a myth. Someone has to prove that with data.
And just yesterday I told someone to visit BBC when trying to connect to public wifi that requires a redirect to a login page first. Guess I'm going to have to find a new go-to http site now
http://something.com or use what Google does when Chrome notifies you of a login gateway to public wifi: http://www.gstatic.com/generate_204
Earlier quoted context omitted.
Washington Post. Buzzfeed. The Guardian. New York Times still dosent have HTTPs.
Their traffic is too high for them to afford it (and probably wouldn't outweigh the SEO uplift)
And just yesterday I told someone to visit BBC when trying to connect to public wifi that requires a redirect to a login page first. Guess I'm going to have to find a new go-to http site now
Space-bar heater :) ON a more serious note, I always use http://example.com . Being reserved and maintained by the IANA for documentation and testing, it's the most stable site I can think of.
> The CPU overhead of TLS encryption has historically been significant. We’ve done a lot of work behind the scenes to improve both the software and hardware layers to minimise the load impact of TLS whilst also improving security. I thought that it hasn't been significant overhead for a while now? related: https://www.maxcdn.com/blog/ssl-performance-myth/ https://istlsfastyet.com/
What they HAVEN'T enabled is Diffie-Hellman Ephemeral suites, which give older clients forward secrecy at a big CPU hit.
So this is an example of performance-tuning your TLS settings. There's also stuff to do with session tickets, session resumption, and eventually they'd also be served using ECDSA certs, once all clients support it, or there is at least a great way to only show the older RSA cert to old clients.
Earlier quoted context omitted.
> Even a 2012 MacBook Air can sign an SSL key in only 6.1 milliseconds. The BBC has to deal with machines much older and much less powerful than that.
Even if it took an ancient machine 10x longer than a 2012 MacBook air, that 61 milliseconds more is really not all that much time in the grand scheme of things. I'm sure the people using these machines that are "much older and much less powerful" than a 2012 macbook air are not expecting sites to load as fast as a newer machine, and probably don't care about the loss of less than 0.1 seconds to load time. If you're r…
> HTTPS has been around since 1996 A blog post about spending several years updating to a protocol that's been around for 2 decades and has been standard for full sites for years. This makes me feel like anyone who has an account on BBC should be afraid of their security practices. Calling a plaintext password leak from BBC right now. EDIT: People are taking this comment more seriously than I intended. I don't actual…
Calling FUD on your comment. It hasn't been "standard on full sites for years", and still isn't now. Only recently with the 'HTTPS everywhere' move has the idea that public sites with no authentication should support HTTPS. And even now, that's not a universally supported opinion, because of its effect on caching. The BBC has used HTTPS on pages with forms that submit secure data, as has been the historic standard. M…