Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Put my entire website behind ssl?

healpay.com

Post reply on HN
Print view View original

11–20 of 23 posts

Re: Ask HN: Put my entire website behind ssl?

#11

Post by rubyskills »

HerraBRE wrote: post #6
mattgaidica wrote: post #4

No. I think the HTTPS in the browser prompts a user to think there is confidential information being passed when your just browsing, so now your break user experience. The app portion could be, and should be for any semi-secret information, but keep the front-end clear of it. Plus any and all external resources in-page must be https, it might hang you or a designer up down the road and break your cert.

I disagree. I might not spring for an EV cert in most cases, but using basic encryption to protect against casual eavesdropping should be the rule, not the exception.

I'm on this boat too. It irritates me that facebook is pretty wishy washy about which urls they decide to encrypt and which they don't...

Re: Ask HN: Put my entire website behind ssl?

#12

Post by rdin »

We had some issues integrating 3rd party systems, such as the Twitter button, which has had an invalid certificate for months now. If your site can live without these bells & whistles, then you should investigate and see if your site can take the performance hit.

Re: Ask HN: Put my entire website behind ssl?

#13

Post by rubyskills »

rdin wrote: post #12

We had some issues integrating 3rd party systems, such as the Twitter button, which has had an invalid certificate for months now. If your site can live without these bells & whistles, then you should investigate and see if your site can take the performance hit.

Wow, I didn't think about twitter's button. :-/ We use the twitter widget.. Do you know if the twitter js is behind a valid cert?

Re: Ask HN: Put my entire website behind ssl?

#14

Post by mattgaidica »

trotsky wrote: post #8

Are there any SEO or other indexing issues that crop up if you're only running TLS?

Encrypting site content increases server load, so response time may lack a little.. and we all know Google does take that into account. Also, it might be important that robot files and sitemaps are under the https protocol. I am guessing Google is pretty darn smart about it, I can only imagine though that a broken certificate throws a red flag.

Re: Ask HN: Put my entire website behind ssl?

#15

Post by [deleted] »

rubyskills wrote: post #13
rdin wrote: post #12

We had some issues integrating 3rd party systems, such as the Twitter button, which has had an invalid certificate for months now. If your site can live without these bells & whistles, then you should investigate and see if your site can take the performance hit.

Wow, I didn't think about twitter's button. :-/ We use the twitter widget.. Do you know if the twitter js is behind a valid cert?

[deleted]

Re: Ask HN: Put my entire website behind ssl?

#16

Post by [deleted] »

rubyskills wrote: post #13
rdin wrote: post #12

We had some issues integrating 3rd party systems, such as the Twitter button, which has had an invalid certificate for months now. If your site can live without these bells & whistles, then you should investigate and see if your site can take the performance hit.

Wow, I didn't think about twitter's button. :-/ We use the twitter widget.. Do you know if the twitter js is behind a valid cert?

[deleted]

Re: Ask HN: Put my entire website behind ssl?

#17

Post by BallinBige »

rubyskills wrote: post #13
rdin wrote: post #12

We had some issues integrating 3rd party systems, such as the Twitter button, which has had an invalid certificate for months now. If your site can live without these bells & whistles, then you should investigate and see if your site can take the performance hit.

Wow, I didn't think about twitter's button. :-/ We use the twitter widget.. Do you know if the twitter js is behind a valid cert?

if only everyone had the twitter bar in their chrome browser :)

Re: Ask HN: Put my entire website behind ssl?

#18

Post by rubyskills »

mattgaidica wrote: post #14
trotsky wrote: post #8

Are there any SEO or other indexing issues that crop up if you're only running TLS?

Encrypting site content increases server load, so response time may lack a little.. and we all know Google does take that into account. Also, it might be important that robot files and sitemaps are under the https protocol. I am guessing Google is pretty darn smart about it, I can only imagine though that a broken certificate throws a red flag.

Ha! Interesting.. I wonder if Google does count that against you since part of their latest algorithm factors in page load times.. though I would think that having your site behind https might give you some extra kudos somewhere.. considering you verified the integrity of your site at least.. (ALTHOUGH, there was that recent security breach where we someone can spoof being a CA...)

Re: Ask HN: Put my entire website behind ssl?

#19

Post by mattgaidica »

rubyskills wrote: post #7
mattgaidica wrote: post #4

No. I think the HTTPS in the browser prompts a user to think there is confidential information being passed when your just browsing, so now your break user experience. The app portion could be, and should be for any semi-secret information, but keep the front-end clear of it. Plus any and all external resources in-page must be https, it might hang you or a designer up down the road and break your cert.

Very good points! It's very interesting to me that when SSL opens up, you immediately feel like confidential information information is going to be passed (which is usually the case).. I didn't think about that before! The app portion is def. protected by SSL and switches to that context when you hit the login path. Your last point is interesting too, as we do pull in external resources such as google fonts, jquery (…

Yea, luckily nearly every major API and service (Amazon, Facebook, Google..) has an encrypted version to pull from. So as long as the entire team understands that, then I only have the usability issue as an argument. If we could get GoDaddy and other hosts to have like a $10 "Add SSL" feature, I think we would see a really good adoption of it being the standard!

Re: Ask HN: Put my entire website behind ssl?

#20

Post by rdin »

rubyskills wrote: post #13
rdin wrote: post #12

We had some issues integrating 3rd party systems, such as the Twitter button, which has had an invalid certificate for months now. If your site can live without these bells & whistles, then you should investigate and see if your site can take the performance hit.

Wow, I didn't think about twitter's button. :-/ We use the twitter widget.. Do you know if the twitter js is behind a valid cert?

Unfortunately, it's been invalid for awhile. You can check it out for yourself here:

http://platform.twitter.com/widgets.js vs https://platform.twitter.com/widgets.js

Post reply on HN