Wow, I didn't expect this ("switching" to HTTPS) to be so hard.
HTTPS on Stack Overflow: The End of a Long Road
11–20 of 183 posts
Re: HTTPS on Stack Overflow: The End of a Long Road
#12Note to self: Use subdirectories, not subdomains in the future
The other issue with subdomains is that some customers will insist on typing "www." in front of every domain. Since the wildcard cert won't match, those customers will see an error.
Re: HTTPS on Stack Overflow: The End of a Long Road
#13Just a reminder, HTTPS isn't enough. Be sure to turn the other security knobs with headers... https://securityheaders.io/?q=https%3A%2F%2Fstackoverflow.co...
Helpful site, but all these headers will slow down a site that doesn't need them. Too bad they aren't defaults. Hopefully http2 mitigates that enough.
Re: HTTPS on Stack Overflow: The End of a Long Road
#14Just a reminder, HTTPS isn't enough. Be sure to turn the other security knobs with headers... https://securityheaders.io/?q=https%3A%2F%2Fstackoverflow.co...
Helpful site, but all these headers will slow down a site that doesn't need them. Too bad they aren't defaults. Hopefully http2 mitigates that enough.
The only header that I can think of that might slow down a site is Content-Security-Policy. Even that is negligible as long as you don't have 1000 entries.
Re: HTTPS on Stack Overflow: The End of a Long Road
#15Note to self: Use subdirectories, not subdomains in the future
I feel like TLS certificates are fundamentally misdesigned there. It should be possible to have a wildcard certificate that matches all subdomains under a domain, no matter how many layers deep.
Re: HTTPS on Stack Overflow: The End of a Long Road
#16Just a reminder, HTTPS isn't enough. Be sure to turn the other security knobs with headers... https://securityheaders.io/?q=https%3A%2F%2Fstackoverflow.co...
Yep - we're aware. I thought about putting in our Content-Security-Policy-Report-Only findings about what all would break, but the post was already a tad long. It's quite a long list of crazy things people do.
As the headers go, here's my current thoughts on each:
- Content-Security-Policy: we're considering it, Report-Only is live on superuser.com today.
- Public-Key-Pins: we are very unlikely to deploy this. Whenever we have to change our certificates it makes life extremely dangerous for little benefit.
- X-XSS-Protection: considering it, but a lot of cross-network many-domain considerations here that most other people don't have or have as many of.
- X-Content-Type-Options: we'll likely deploy this later, there was a quirk with SVG which has passed now.
- Referrer-Policy: probably will not deploy this. We're an open book.
Re: HTTPS on Stack Overflow: The End of a Long Road
#17Just a reminder, HTTPS isn't enough. Be sure to turn the other security knobs with headers... https://securityheaders.io/?q=https%3A%2F%2Fstackoverflow.co...
Yep - we're aware. I thought about putting in our Content-Security-Policy-Report-Only findings about what all would break, but the post was already a tad long. It's quite a long list of crazy things people do. As the headers go, here's my current thoughts on each: - Content-Security-Policy: we're considering it, Report-Only is live on superuser.com today. - Public-Key-Pins: we are very unlikely to deploy this. Whenev…
Great! Thanks for the detailed response!
Expect-CT is one to look at as well.
Basically just tells the browser that Certificate Transparency should be available through the provider (DigiCert in this case).
Re: HTTPS on Stack Overflow: The End of a Long Road
#18At $previous_job we once turned on HTTPS for our entire customer website and online store, only to have our customer support team be bombarded by phone calls claiming that our "website was down." After much teeth gnashing and research, we determined that a large segment of our user base was still using WinXP and the encryption protocols we offered weren't available to them. We didn't think this would be a problem bec…
Out of curiosity - roughly what year was that and what percentage of the customer base would you say was still on Windows XP at the time?
Re: HTTPS on Stack Overflow: The End of a Long Road
#19Note to self: Use subdirectories, not subdomains in the future
I feel like TLS certificates are fundamentally misdesigned there. It should be possible to have a wildcard certificate that matches all subdomains under a domain, no matter how many layers deep.
Well if it wasn't for someone buying .com back in the day, we probably could have them. Oh and then buying ..com after browsers banned that one, which led to RFC 6125 rule clarifications and restrictions.
Re: HTTPS on Stack Overflow: The End of a Long Road
#20Note to self: Use subdirectories, not subdomains in the future
TLS kills this kind of "cool" features which is kind of sad :( Unless you can afford wildcard certs. What's the argument behind LetsEncrypt not doing that? Extended Validation stuff?
Subdomains were killed by SEO a long time ago (afaik, Google does not transfer domain PageRank credit to subdomains), so this is not limited solely by the cost of wildcard certs.