Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Static Websites Need HTTPS

troyhunt.com

Post reply on HN
Print view View original

261–268 of 268 posts

Re: Why Static Websites Need HTTPS

#261

Post by dragonwriter »

chopin wrote: post #254
yardstick wrote: post #143

Earlier quoted context omitted.

> HTTPS doesn't protect the content of your site from being stolen, it protects your users from hostile third-party content masquerading as yours. Hostile third party content is only hostile because the client used to access the content does not take client security seriously. Food for thought: As an end user consumer visiting random, benign websites, I want my browser to be protecting me against hostiles, rather tha…

Just make it so that your browser doesn't render any http delivered content. Problem solved. From a client point of view that's the only protection you can do. A MITM over http is undetectable for you. With current OSes and hardware there is no sandboxing which will protect you under all circumstances. If you do this, site providers are forced to switch to https anyway.

> If you do this, site providers are forced to switch to https anyway.

No, if everyone does this, providers are forced to switch. If you do it, it just means you're cut off from some portion of the web.

Re: Why Static Websites Need HTTPS

#262

Post by ValentineC »

mr_toad wrote: post #237
ecesena wrote: post #196

Github pages supports TLS even for custom domains now, via Let's Encrypt. At this point, I don't think there's any excuse anymore for having a static website without TLS. Either use Github pages, or just use your favorite hosting provider and put a CDN in front of it. Note: I'm not affiliated to Github, but I've used them multiple times, and just recently discovered they now support TLS. If you want to see an example…

As far as I know Github is the _only_ static site provider that will do this for you. I’m scratching my head trying to figure out the best way to do automated certificate renewal for othe providers. It’s not like you can run certbot on a static page.

> As far as I know Github is the _only_ static site provider that will do this for you.

Netlify automatically does this [1], and Zeit's Now too, I think [2].

[1] https://www.netlify.com/docs/ssl/

[2] https://zeit.co/docs/examples/static

Re: Why Static Websites Need HTTPS

#263

Post by msla »

Qub3d wrote: post #89

I'm going to sorta break the prime directive and link the n-gate rebuttal to these articles: http://archive.fo/xcQ5j Its a bit heavy-handed, but it does bring up a good point: A lot of this argument for HTTPS-by-default is all on top of assumptions about who is responsible for data security. We're doing a lot and things are improving, but the general public still are all yelling at websites for misusing data that we…

The fact that site gets "erased" partway down, as if attacked by an evil MiTM, proves it's not serious and is, in fact, arguing for HTTPS.

Re: Why Static Websites Need HTTPS

#264

Post by EGreg »

CM30 wrote: post #256
EGreg wrote: post #251

Earlier quoted context omitted.

Why do you want to type in URLs? It’s like the command line before it was replaced by GUIs for the majority of people who are non technical.

Because people don't just send URLs around online? If you tell people your site address in person/by phone/in a non tech context, they need to be able to type it in easily enough.

So you can just have your company’s NAME on Google let’s say. Many people actually type stuff into Google instead of the address bar. They don’t even know the difference!

And honestly, I know what it is like to dictate a phone number or name over the phone. You have to spell it out, then they say it back to you. They say “C like Charlie”. Seriously? This is what you are saying people will WANT to preserve this crap?

No way. People will be very happy to get rid of dictating stuff on the phone. How about AT LEAST copypasting into a text? Using words to dictate an address or phone number requires error correction and super slow annoying transmission.

And if you DO tell people something, it is usually typed into a search engine. What if I want to share a URL that’s more complex than “nytimes.com”? What if I want to share an article on NYTimes? HAVE YOU EVER DICTATED THAT TO SOMEONE? So come on. The most you can comfortably do via manually typing what you heard into an address line is to go to the fromt page of a website. That’s a tiny subset of the URLs.

Re: Why Static Websites Need HTTPS

#265

Post by logan12358 »

berbec wrote: post #106
Fnoord wrote: post #51

What if your website is only accessible for you from within your LAN? Such as your router, LAN, or your settopbox? If you have DHCP as well and don't control the DNS or don't have root (such as on IoT devices) then you cannot use Lets Encrypt. Or am I missing something?

I used to have a $75 netgear router at my house. I changed the local DHCP settings to give out a raspberry pi's internal as DNS. I run dnsmasq on the pi and resolve local hosts that way. Ever internal service in my house uses HTTPS and I have about a dozen.

Sorry this is a day late, but how do you get certificates for internal services? Do you manually trust them on each client? Or do you have a wildcard cert from a public server? Is there some cleaner way to manage internal HTTPS?

Re: Why Static Websites Need HTTPS

#267

Post by berbec »

logan12358 wrote: post #265
berbec wrote: post #106

Earlier quoted context omitted.

I used to have a $75 netgear router at my house. I changed the local DHCP settings to give out a raspberry pi's internal as DNS. I run dnsmasq on the pi and resolve local hosts that way. Ever internal service in my house uses HTTPS and I have about a dozen.

Sorry this is a day late, but how do you get certificates for internal services? Do you manually trust them on each client? Or do you have a wildcard cert from a public server? Is there some cleaner way to manage internal HTTPS?

I resolve internal services as subdomains of a domain I own. I use a wildcard I get assigned on an EC2. I script an sftp upload of the a new cert every renewal to my main internal machine where it is shared via nfs. This is the simplest way I've found.

Re: Why Static Websites Need HTTPS

#268

Post by alerighi »

The drawback to use https everywhere is that a big company can't cache locally things that gets downloaded again and again from the network like OS and application updates, videos on the web, and so on

I think that we need an alternative to https, a protocol that guarantees only authentication (sing the packets, basically) and doesn:t encrypt content, you can verify that what you get is what the website owner intended (no mitm) and you can have a cache.

Post reply on HN