Oh no, this was my go-to site whenever I had to login to public wifi and https wouldn't redirect :(
http://example.com is my go-to for those.
Heh, I use http://foo.com
HTTPS on NYTimes.com
131–140 of 167 posts
Re: HTTPS on NYTimes.com
#132Earlier quoted context omitted.
no
Actually, it shouldn't matter. A trailing dot in a hostname signifies a fully-qualified domain name, rather than a relative domain name. Without the dot the router's dns service could technically return 'cbc.ca.some.othersite.net.' as the FQDN. For those interested, learn more at: http://www.dns-sd.org/trailingdotsindomainnames.html https://en.wikipedia.org/wiki/Fully_qualified_domain_name
They meant the period in the middle (as in, "can you type the full thing, including the period in the middle, with one hand?"). I read it the same way as you did, initially.
Re: HTTPS on NYTimes.com
#133Earlier quoted context omitted.
To be fair, it's more secure in the sense that someone who gets access to their domain name service can't generate their own OV cert without more access. They could however create their own DV cert. So while it uses the same technology, if you see an OC cert you can be more sure that it's the actual organization and not a cert that just proves that the domain is the domain.
But unless clients or humans do anything in response to the extra OV information, or in response to a lack of the extra OV information, that information has no security value. No browsers do anything with OV data unless humans manually take action to examine the certificate. So I'm comfortable saying they offer negligible security value.
I think if a browser said "hey, this site used to have an OV cert, but now has a DV cert", and explained why that could be bad, that could be useful, though many non-technical users would probably not get the distinction. Sure, they don't do that now, but UI/UX around TLS has been improving a lot over the past few years.
(Certificate Patrol's noting of the reverse is a little silly though; why would you flag a change that denotes an increase in security...?)
Re: HTTPS on NYTimes.com
#134Earlier quoted context omitted.
This is an issue we're encountering. One solution is trust on first use of a self signed cert, which makes the scary untrusted page a one time cost. This isn't terribly easy in the browser though. With more IOT devices entering the market, this could become a more common issue. Using https for a local network connection will also be more common, in the case you decide you don't trust the network.
I think for the case of the home router admin page (or really any admin page on your local network), the browser can easily detect that it's being served a page on the local net, and could provide a less scary warning that has some text that acknowledges that you're on your local net and that either ignoring the password form security warning (for http) or accepting the self-signed cert (for https) is probably ok. Wh…
It absolutely makes sense not to display warnings that HTTPS isn't in use in circumstances where HTTPS is not feasible - i.e. local addresses. It's simple enough for a browser to determine. I don't think conditionally accepting a self-signed cert is necessary.
Re: HTTPS on NYTimes.com
#135Earlier quoted context omitted.
OV are considered more secure than DV due to the higher registration requirements[0]. Additionally a DV certificate is good for a single domain, OV certificates are good for all of that organisation's domains. For example the NYT's certificate is valid for: DNS Name=nytimes.com DNS Name=*.blogs.nytimes.com DNS Name=*.blogs.stg.nytimes.com DNS Name=*.dev.nytimes.com DNS Name=*.nyt.com DNS Name=*.nytimes.com DNS Name=*…
DV certs can certainly have wildcards and multiple domains, and no, OV certs are not "more secure" - they simply contain additional fields which suggest that a CA has taken some amount of effort to verify that the domains belong to a given organisation, which the end user can read. This is generally more-or-less useless, as I'm pretty sure we all know that nytimes.com is owned by the New York Times.
And who reads the certificate anyway? I've never heard that an end user actually reads the content of the certificate. They just look for the green lock.
It would often be confusing anyway, as the legal entities the certificate is issued to can be named very different from the brand.
Re: HTTPS on NYTimes.com
#136They mention it has been a complex undertaking and not complete yet - does anyone know why they can't just sit a traffic manager in front of everything with SSL offloading? Also does anyone know what the new personalisation features are that they mention being able to offer now HTTPS in place?
According to WaPo's move to HTTPS blog post: >Ask any developer at a major media organization what the biggest hurdle to HTTPS adoption is, and the answer is always going to be advertising. However, unless you understand the ins-and-outs of how digital advertising is implemented, it’s difficult to see why this presents a challenge. from https://developer.washingtonpost.com/pb/blog/post/2015/12/10...
Fortunately, even that is changing. Google forced advertisers who want to buy inventory through AdX to switch their creatives to HTTPS in 2015 already. In my experience, any non-compliance to that comes from shitty agencies that haven't gotten the memo that you're better off just switching everything to HTTPS these days.
Re: HTTPS on NYTimes.com
#137Earlier quoted context omitted.
Sure, that works fine for specific articles but I miss the serendipity.
Is it not enough to do Preferences / Privacy / Cookie Exceptions and choose to not accept cookies from them? I block a lot of sites which started to personalize content in an unwanted way.
If you block their cookies, they serve a funny login page everywhere.
Re: HTTPS on NYTimes.com
#138They mention it has been a complex undertaking and not complete yet - does anyone know why they can't just sit a traffic manager in front of everything with SSL offloading? Also does anyone know what the new personalisation features are that they mention being able to offer now HTTPS in place?
For our media website, it took us one year before we could move to HTTPS, mainly because of the AdServers which wasn't ready. We had to talk to each ad provider in order to ask them to upgrade to HTTPS. Unfortunately as media companies have most of their revenue from ads you just can't switch like that. Also, features that are now available once the HTTPS by default on a website, is the AMP, Notifications, HTTP2 (fas…
Google started the process of enforcing HTTPS on AdX about 2.5 years ago. Not implementing HTTPS in that large timeframe is rather inexcusable. It's just technical debt that you need to acknowledge, and then get rid of it.
Re: HTTPS on NYTimes.com
#139The thing the NYT needs to fix (as of earlier last year) is the fact that you can't cancel your subscription without calling them (which is not the case for signing up). I spent 20 minutes[1] on the phone telling them that yes, I really did want to cancel. It was a worse experience than dealing with Comcast, not least because I felt bad for the poor woman who obviously had some financial incentive to get me to stay o…
I found "I'm emigrating next month" was very effective at getting an immediate cancellation with several services I used to use.
Re: HTTPS on NYTimes.com
#140It's nice to see more news media moving towards using HTTPS. NYTimes now joins a small club, alongside the Guardian and the Washington Post. Here's a dev blog post on the WaPo moving to https: https://developer.washingtonpost.com/pb/blog/post/2015/12/10... And one on the Guardian moving to https: https://www.theguardian.com/info/developer-blog/2016/nov/29/...
The Intercept uses HTTPS.
Would be ironic for them not to.