Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Will Soon Shame All Websites That Are Unencrypted

motherboard.vice.com

Post reply on HN
Print view View original

161–170 of 369 posts

Re: Google Will Soon Shame All Websites That Are Unencrypted

#161

Post by BinaryIdiot »

callmeed wrote: post #156

Consider this: - Squarespace doesn't support SSL (other than on their ecommerce checkout pages) [1] - Weebly only allows it on their $25/mo business plan [2] - Wordpress.com doesn't support SSL for sites with custom domains [3] - If you've never experienced the process of requesting, purchasing, and then installing an SSL certificate using a hosting control panel like Plesk or cPanel, let me tell you–it's a nightmare…

Yeah I'm all for SSL shaming but my personal site with SquareSpace is about to look like shit for me since I'm a web developer. I mean as a web developer it's not going to look good if your portfolio is shown with a security warning.

I wonder if SquareSpace is going to finally fix their shit or if I'm going to have to move elsewhere which is going to be a pain (I went with SquareSpace because I didn't want to be assed with dealing with much of anything for a personal site).

Re: Google Will Soon Shame All Websites That Are Unencrypted

#162

Post by jtreminio »

yeukhon wrote: post #82
cryptoz wrote: post #76

Earlier quoted context omitted.

Similarly, Google claimed they would start penalizing websites that showed full-page ads for mobile apps instead of showing you the website. But every single time I try to get to Gmail, or Drive, or Calendar, or any Google service on the web using a mobile device, I'm shown a full page ad for a mobile app. Google has been doing this for years, and it seems like it's also been a year since they said they'd punish all…

Yahoo shows YMail. Bing is the only one shows Gmail as first, although Yahoo technically uses Bing. You can pretty much say Yahoo actually "put herself above others" and more guilty than Google. In fact, I don't think Google is doing anything wrong. After all, Gmail is popular, and if you are doing a Google search, the user may be interested to know Google also offer email and most likely the user is already a Google…

> You can pretty much say Yahoo actually "put herself above others"

Do you mean `itself`? Since when are tech companies assigned genders?

Re: Google Will Soon Shame All Websites That Are Unencrypted

#163

Post by cellularmitosis »

schoen wrote: post #154
x0 wrote: post #104

Earlier quoted context omitted.

Seriously this. I don't see why encryption and website verification have been wrapped up in the same thing (SSL certs). They're two different things. Encryption should be free, automatic and default.

If you don't have a way to confirm that the key you're seeing from the other site is right, you're inherently vulnerable to a man-in-the-middle attack which removes the benefits of the encryption against the attacker. https://en.wikipedia.org/wiki/Man-in-the-middle_attack httpS://en.wikipedia.org/wiki/Zooko's_triangle It's not clear that the certificate authority system was or is the best solution to this problem, bu…

However, having one and not the other isn't totally useless.

Having the browser be able to track and tell me that "Though we aren't sure this is actually google.com, we do know that the exact same cert has been used the last 50 times you visited this website" is something I'd consider to be useful. (Actually, telling me if it changes would be the useful bit).

That would be at least be useful for self-signed certs (though those aren't really needed in light of Let's Encrypt...)

Re: Google Will Soon Shame All Websites That Are Unencrypted

#167

Post by nailer »

jtreminio wrote: post #162
yeukhon wrote: post #82

Earlier quoted context omitted.

Yahoo shows YMail. Bing is the only one shows Gmail as first, although Yahoo technically uses Bing. You can pretty much say Yahoo actually "put herself above others" and more guilty than Google. In fact, I don't think Google is doing anything wrong. After all, Gmail is popular, and if you are doing a Google search, the user may be interested to know Google also offer email and most likely the user is already a Google…

> You can pretty much say Yahoo actually "put herself above others" Do you mean `itself`? Since when are tech companies assigned genders?

Parent poster might not be from an English-speaking background.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#168

Post by crisnoble »

threesixandnine wrote: post #141
artichokeheart wrote: post #78

I think one of the big problems with unencrypted websites is shared hosting, who refuse to use SNI certificates (often because it would require upgrading their infrastructure). So users have to pay for a static IP which effectively doubles their hosting costs so most don't bother.

If they don't bother why should people bother to pay for their hosting? There are many, many hosting companies that do bother and I am using one of them. Had no problem installing Let's Encrypt cert on shared hosting via cPanel there.

Who are you using?

Re: Google Will Soon Shame All Websites That Are Unencrypted

#169

Post by [deleted] »

schoen wrote: post #152
blakeyrat wrote: post #145

Earlier quoted context omitted.

Ok I'm new to this and I know it's still beta, but it seems: 1. Still WAY too complicated (look at all the stuff you have to know and type) 2. Doesn't seem to support my preferred OS (Windows) or web server (IIS) what-so-ever. Which is strange since, from my experience, installing certs in IIS is already far easier than in Apache and Nginx. (Although maybe that's why they perceive it as less of a priority?)

Hi, I think the IIS support effort that's furthest along is described at https://community.letsencrypt.org/t/how-letsencrypt-work-for... ; maybe that will be useful for you if you want to try Let's Encrypt on your IIS system. We've had hundreds of people remark that they found Let's Encrypt faster and easier to use than other CA offerings (though most of those people were using Apache on Debian-based systems), so I t…

[deleted]

Re: Google Will Soon Shame All Websites That Are Unencrypted

#170

Post by Syrup-tan »

schoen wrote: post #152
blakeyrat wrote: post #145

Earlier quoted context omitted.

Ok I'm new to this and I know it's still beta, but it seems: 1. Still WAY too complicated (look at all the stuff you have to know and type) 2. Doesn't seem to support my preferred OS (Windows) or web server (IIS) what-so-ever. Which is strange since, from my experience, installing certs in IIS is already far easier than in Apache and Nginx. (Although maybe that's why they perceive it as less of a priority?)

Hi, I think the IIS support effort that's furthest along is described at https://community.letsencrypt.org/t/how-letsencrypt-work-for... ; maybe that will be useful for you if you want to try Let's Encrypt on your IIS system. We've had hundreds of people remark that they found Let's Encrypt faster and easier to use than other CA offerings (though most of those people were using Apache on Debian-based systems), so I t…

You have a ";" at the end of your URL which breaks it.

https://community.letsencrypt.org/t/how-letsencrypt-work-for...

Post reply on HN