171–180 of 264 posts
Are there any downsides to these free certs? Do they work in all browsers; is there anything that could be better security-wise? If not, than this is exactly what we need to establish HTTPS as the new standard.
Earlier quoted context omitted.
> no 3rd parties can snoop on your data And Google is what... ?
Someone you are willfully sending information about requests to? What's so hard to understand. Just because you let your doctor put his finger in your ass doesn't mean you want to let everyone...
Excellent guide but unfortunately StartSSL does not support all top-level domains. I went through the trouble of registering with StartSSL, they even issued a client certificate for my email account at .tk domain, but they refuse to issue SSL server certificates for any .tk domain. Even though this is a perfectly legitimate top-level domain (yes I paid for a real .tk domain, and I fully control the DNS settings just…
Earlier quoted context omitted.
SSL Labs does a great job of SSL testing domains and making recommendations: https://www.ssllabs.com/ssltest/analyze.html?d=konklone.com I developed my nginx config based on their recommendations: https://gist.github.com/konklone/6532544
Instead of using nginx or a Web server for SSL, you might consider using something like stunnel for SSL termination as recommended by 'cperciva: "...for security reasons, I prefer to keep SSL termination separate from HTTP serving" ( http://colin.percival.usesthis.com , http://www.daemonology.net/blog/2009-09-28-securing-https.ht... ). In his 2010 talk "Everything you need to know about cryptography in 1 hour" ( http…
My main concern about a scheme like this is the vulnerability to SSL stripping.
I'm not sure what you can do mitigate it apart from have SSL on all the time, HSTS telling the browser that it should be using SSL and hoping that the first time a user comes to your site is via a https link.
Using HTTPS everywhere doesn't really help much. It doesn't help at all if the surveillers either have your cert or access to decrypted traffic inside the firewall. Any PII being sent over the wire should most definitely be encrypted, but encrypting my access to a news site isn't really hiding anything. The requested URL still need to be unencrypted, you'd just be encrypting content that is already availble unencrypt…
The particular publicly-available information that people are interested in is privacy-sensitive. It's easiest to see this by thinking about articles on sexual, medical, and religious topics at Wikipedia (or WebMD!). Although the information is public, users don't want others on the network to know that they read it. And on some networks, the content of news articles that we might think of as totally innocuous is con…
So how do you know if the content you're reading has not been tampered with? You don't, unless the connection is encrypted.
Earlier quoted context omitted.
You could have just bought the $7 cert from getssl.me and it would take 2 minutes at most.
They just resell Comodo certificates, so I assume I'd have the same issues with broken emails and offline managment area and emails promising "Your order is being processed right now" (the business validation stuff was only a part of the problem) Also, it makes me angry how you have all those beautifully designed landing pages everywhere, and as soon as you have ordered, you have to deal with ugly and confusing websi…
Earlier quoted context omitted.
It's been studied and pointed out that a green-bar does nothing to conversions and sales. I'm not debating this point, but if you have some citations for this assertion, I'd love to read them. I've always heard and read otherwise. I just completed a multiple-month-long process of converting a dynamic-domain application to support SSL-friendly URIs and implementing SSL on it's web servers based entirely on the concept…
> I've always heard and read otherwise. Those "Get better conversion rates with EV Certs" internal studies are pure marketing B.S. by the SSL vendors. Do not trust what they say. Every single person that has tested this on his site has come to the same exact conclusion - the green-bar has no meaning to the consumer, nor do they even notice it. http://www.theroiteam.com/blog/is-an-ev-ssl-worth-it-or-even... http://web…
Earlier quoted context omitted.
Note that Wikipedia supports HTTPS, but it is not the default (yet).
Funny, it is for me: any wikipedia page redirects to its https counterpart. E.g. http://en.wikipedia.org/wiki/Hacker_News redirects to https://en.wikipedia.org/wiki/Hacker_News .
Earlier quoted context omitted.
SSL Labs does a great job of SSL testing domains and making recommendations: https://www.ssllabs.com/ssltest/analyze.html?d=konklone.com I developed my nginx config based on their recommendations: https://gist.github.com/konklone/6532544
We just scored F: https://www.ssllabs.com/ssltest/analyze.html?d=scirra.com But I'm not quite sure what I need to do to make it better?
Oh, the sweet irony - > SSL’s not perfect, but we need to make surveillance as expensive as possible immediately followed by - > And hey, bonus: more complete referrer information in Google Analytics Make up your mind already. Are you against the surveillance or for it? You can't really sit with one ass on two chairs. -- (edit) Point being is that if you are pulling the anti-surveillance card, then you shouldn't real…
# Screw Google...
127.0.0.1 www.google-analytics.com
127.0.0.1 ssl.google-analytics.com