Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Switch to HTTPS Now, For Free

konklone.com

Post reply on HN
Print view View original

131–140 of 264 posts

Re: Switch to HTTPS Now, For Free

#131

Post by bigiain »

AhtiK wrote: post #89

> And hey, bonus: more complete referrer information in Google Analytics It's interesting, I did switch to HTTPS for all my sites but Google Search still did not reveal search keywords to Google Analytics from users logged in at Google. If that's what was referred as "referrer information". Did anyone get lucky with getting 100% of google search keywords after switching to SSL?

What he meant was that Google Analytics will correctly identify visitors coming from a link on a SSL secured site (for example https://news.ycombinator.com ) if your set is SSL secured as well - all browsers strip the referrer header if they're going from an https page to an http one.

Google search queries/keywords are a different issue - Google is intentionally making it impossible to see most of those (presumably, they've got a plan about how to sell that information to marketers using Adwords…)

Re: Switch to HTTPS Now, For Free

#132

Post by mmagin »

cpeterso wrote: post #82

You can also get free SSL certificates from LOLroot CA! http://lolroot.ca/

That's dumb.

If you're going to install a new root certificate on all your client machines, you could just as well generate your own CA inside your organization and do the same thing without trusting some third party.

(Edit: I think I've been trolled.)

Re: Switch to HTTPS Now, For Free

#133

Post by uxp »

jbrechtel wrote: post #84
jakobe wrote: post #69

Earlier quoted context omitted.

But then I'd need to support SSL for all domains hosted on the server, and this would mean getting 5 certificates instead of one.

That's not true. Why do you think that?

Actually it is, because you'd still have a domain pointed to an IP address listening on 443, and that IP address wouldn't know how to handle the domain that is not configured to listen on 443, so it would serve the default domain (generally the first SSL-configured domain with Apache, or 'default_server' on Nginx). This means you'll be serving a certificate for your default site 'foo.com' when you requested 'bar.org', providing the user with a domain mismatch security warning.

The second non-solution would be to configure every domain with self-signed certificates, but then you'd still be sending your clients an untrusted certificate. The only way to truly provide SSL on a shared host is to configure it with a UCC certificate that includes every domain you are pointing at it, or generate cheap/free certificates like StartSSL's for every unique domain and subdomain you listen for.

Re: Switch to HTTPS Now, For Free

#135

Post by micahflee »

jakobe wrote: post #38
dangrossman wrote: post #24

Earlier quoted context omitted.

I would be willing to bet over 95% of SSL-secured sites don't have business validation certificates. Given virtually nobody visiting your site will know what that means, let alone how to check anything about the certificate you're using, it just doesn't make sense to pay extra for no benefit. A domain-validated certificate costs less while providing the same padlock icon and level of encryption, and takes just minute…

In my case, I don't care about encryption. On my website, I only offer software for download. No private data. Payment is handled by a third party. The only reason why I want to support https is so that customers can confirm who they are downloading from. Ideally, I'd like an EV certificate, but I can't afford that. So I chose a business validation cert. A domain only certificate wouldn't really confirm anything. (Al…

If you offer software to download HTTPS is a must. Otherwise any active attacker, from a kid at a coffee shop to the NSA at the ISPs, can make it so when people download your software they're also downloading your software with malware attached. Software downloads are one of the most important things to protect, and it saddens me that some websites still exist that offer software downloads that don't use HTTPS.

Re: Switch to HTTPS Now, For Free

#136

Post by powertower »

uxp wrote: post #130
powertower wrote: post #117

Earlier quoted context omitted.

Except not even 99.9995% of your customers will know or care about the level of your SSL Cert. It really does not add anything to the equation. Just extra costs and work for you. It's been studied and pointed out that a green-bar does nothing to conversions and sales. I suggest skipping it always, but often times a higher business type will override the suggestion of whomever has to implement it and maintain it - sim…

It's been studied and pointed out that a green-bar does nothing to conversions and sales. I'm not debating this point, but if you have some citations for this assertion, I'd love to read them. I've always heard and read otherwise. I just completed a multiple-month-long process of converting a dynamic-domain application to support SSL-friendly URIs and implementing SSL on it's web servers based entirely on the concept…

> I've always heard and read otherwise.

Those "Get better conversion rates with EV Certs" internal studies are pure marketing B.S. by the SSL vendors. Do not trust what they say.

Every single person that has tested this on his site has come to the same exact conclusion - the green-bar has no meaning to the consumer, nor do they even notice it.

http://www.theroiteam.com/blog/is-an-ev-ssl-worth-it-or-even...

http://webmasters.stackexchange.com/questions/7697/ev-ssl-ce...

http://forum.x-cart.com/showthread.php?t=54707

http://www.quora.com/VeriSign/Does-ecommerce-conversion-incr...

Re: Switch to HTTPS Now, For Free

#137

Post by cpncrunch »

mrb wrote: post #66

Summary: obtain a certificate from StartSSL. They provide free certificates as long as it is for an individual, not a company's website. Their process to get a cert is a little more difficult that the competition, but konklone.com provides a nice step-by-step guide.

Nope, you can use it for a company as well.

Re: Switch to HTTPS Now, For Free

#138

Post by benblodgett »

powertower wrote: post #117
vacri wrote: post #60

Earlier quoted context omitted.

Business validation is what you should be using for a business site. It's actually a good thing and means that the company is interested in verifying who you are. I went through the dance with Startcom and agree with the article that the web interface has horrible workflow. However they were clearly doing their best to verify that it actually was a business they were creating an account for. For example, they ignored…

Except not even 99.9995% of your customers will know or care about the level of your SSL Cert. It really does not add anything to the equation. Just extra costs and work for you. It's been studied and pointed out that a green-bar does nothing to conversions and sales. I suggest skipping it always, but often times a higher business type will override the suggestion of whomever has to implement it and maintain it - sim…

I agree it shouldn't change conversions, but I would also like to see some data supporting that. I run a lot of ecommerce sites and couldn't imagine the number of transactions not dropping if I just removed my SSL from every site.

Re: Switch to HTTPS Now, For Free

#139

Post by rurounijones »

tjohns wrote: post #21
ewolf wrote: post #4

Are there any downsides to these free certs? Do they work in all browsers; is there anything that could be better security-wise? If not, than this is exactly what we need to establish HTTPS as the new standard.

There are some minor caveats, but nothing really worth worrying about. Most browsers accept StartCom certs these days, so that's not a concern unless you're supporting ancient systems. The big difference is in how much validation is done. The cheap certs only offer domain verification; in other words, they verify that the person holding the certificate owns the domain in question. Typically via an automated email to…

The fact that EV certificates exist in the first place is an indication in my mind just how badly CAs messed up the certs originally. ("We need to sell more! Get rid of the checks")

It also drives me nuts that browsers still class self-signed certs below normal (non-ev) certs when they basically offer the same level of guarantees (in terms of "this person is who they claim to be")

Re: Switch to HTTPS Now, For Free

#140

Post by dgesang »

powertower wrote: post #117
vacri wrote: post #60

Earlier quoted context omitted.

Business validation is what you should be using for a business site. It's actually a good thing and means that the company is interested in verifying who you are. I went through the dance with Startcom and agree with the article that the web interface has horrible workflow. However they were clearly doing their best to verify that it actually was a business they were creating an account for. For example, they ignored…

Except not even 99.9995% of your customers will know or care about the level of your SSL Cert. It really does not add anything to the equation. Just extra costs and work for you. It's been studied and pointed out that a green-bar does nothing to conversions and sales. I suggest skipping it always, but often times a higher business type will override the suggestion of whomever has to implement it and maintain it - sim…

> It's been studied

Got any source? Would really like to show that to some folks here ...

Post reply on HN