71–74 of 74 posts
Earlier quoted context omitted.
I don't want to pile on, but security vulnerabilities are often composed of a series of seemingly insignificant weaknesses that get chained together in highly clever ways. Anything that is accessed over http gives a potential attacker the ability to monitor activity, MitM, spread misinformation, and find potential other footholds that can be composed into a larger attack.
TLS ads a lot of complexity and with it come additonal vulnerabilities that a HTTP-based site doesn't have - e.g. most famously Heartbleed.
> with it come additonal vulnerabilities that a HTTP-based site doesn't have
This strikes me as being a very strange point to make. HTTP includes no security whatsoever. HTTPS includes quite a lot of security. HTTPS may have vulnerabilities, but even so it's still certainly far more secure than HTTP.
Earlier quoted context omitted.
Reverse proxies usually require configuration changes to work. Plus they are single points of failure. Server Name Indication (SNI) is a fairly recent development as well - any apps written before that was widespread, or designed in that way, will have a unique web server for every HTTP based service that has its own separately managed certificate. Reverse proxying is less common in wild IoT devices, network applianc…
The initial RFC for SNI is 20 years old this year. It's been in OpenSSL for 19 years. Plus - Unless the client is outside of a browser context, you can drop an nginx instance in front of the service without the service having any clue. Throw a load balancer in front and it's probably much more robust than a single service. Honestly - reverse proxy support is one of the more magical parts of http.
Earlier quoted context omitted.
Not if you are using tools like letsencrypt, something most blogs and small university projects would readily use. Yes there may be a breaking change in the future but it's quite set and forget at this point.
Seeing as there are severs that are still running but have expired (letsencrypt) certificates, yes it is unquestionably harder.
If servers have an 80% survival chance, and a 95% certificate renewal chance, you'll only see the servers that are running with expired certs. You won't see the inverse.