Uh. What if a site doesn't need https? Like if it has just static pages with public content?
Google to prioritise secure websites
21–30 of 44 posts
Re: Google to prioritise secure websites
#22Uh. What if a site doesn't need https? Like if it has just static pages with public content?
Even a public static site needs HTTPS, for authentication and integrity: https://news.ycombinator.com/item?id=8146670
Re: Google to prioritise secure websites
#23Earlier quoted context omitted.
Yes, we are going to make SSL certificates available to customers on our free plan for free.
Nice! Which CA are you using?
I can't reveal that at the moment. That will be part of the announcement in mid-October. I can say that this will not require anyone to install new root certs in browsers etc.
Re: Google to prioritise secure websites
#24Uh. What if a site doesn't need https? Like if it has just static pages with public content?
Indeed. My static blog hosted on Linode behind Apache has survived a HN frontpage entry three times now. If I have to use HTTPS, does that mean I need a beefy server with lots of entropy?
Re: Google to prioritise secure websites
#25Uh. What if a site doesn't need https? Like if it has just static pages with public content?
Indeed. My static blog hosted on Linode behind Apache has survived a HN frontpage entry three times now. If I have to use HTTPS, does that mean I need a beefy server with lots of entropy?
No. My HTTPS blog hosted on Linode's smallest plan has survived a HN front page without any trouble. It's a myth that HTTPS causes significant resource overhead.
As for entropy, your server only needs a small amount of entropy to seed a CSPRNG, and the CSPRNG takes it from there.
Re: Google to prioritise secure websites
#26"The decision could encourage more sites to turn on encryption, which makes them less vulnerable to hacking". What? This is entirely wrong. It makes them more vulnerable to hacking. There is a whole lot more complex software and configuration to get right, and we know SSL doesn't have a great recent history of that.... Of course it help secure the communications which presumably is what they meant but it's 100% wrong…
If you consider stuff like sniffing cookies to steal sessions as hacking, which most people do, then it's true. In terms of compromising the server you're right
As somebody else pointed out recently in another thread, being able to steal session cookies can even help you attack the server directly, as authenticated users usually have more/different write access to databases and the like, making (e.g.) SQL injections easier. In this regard, even if you don’t consider it “hacking a website” if someone steals session cookies, HTTPS makes it more difficult to “hack websites” in the sense of “getting root access to the server”.
How that compares to the increased attack surface of the HTTPS implementation is of course up for debate.
Re: Google to prioritise secure websites
#27Uh. What if a site doesn't need https? Like if it has just static pages with public content?
Indeed. My static blog hosted on Linode behind Apache has survived a HN frontpage entry three times now. If I have to use HTTPS, does that mean I need a beefy server with lots of entropy?
Nope!
Google, from 2010: "On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10KB of memory per connection and less than 2% of network overhead."
https://www.imperialviolet.org/2010/06/25/overclocking-ssl.h...
Entropy is a different matter, but I believe pretty much all virtualisation platforms have ways to ensure the VMs have enough entropy sources - so it should be fine.
Re: Google to prioritise secure websites
#28Uh. What if a site doesn't need https? Like if it has just static pages with public content?
Indeed. My static blog hosted on Linode behind Apache has survived a HN frontpage entry three times now. If I have to use HTTPS, does that mean I need a beefy server with lots of entropy?
See "Is TLS Fast Yet?": https://istlsfastyet.com/
Re: Google to prioritise secure websites
#29Related: https://news.ycombinator.com/item?id=8146660
It's good to see CloudFlare are going to make this free. In planning the launch of my own new site/blog/thing (hopefully launching soon), the one thing that's really stopping me considering SSL isn't the cost of certificates (which can be had for peanuts anyway if you don't care too much which CA you use) it's the ongoing costs and increased server load. Right now, launching without CloudFlare would almost certainly…
I'm don't know the details about your stack, but while the processing cost of SSL is not neglectable, i think you might be overestimating it.
I can not think of any scenario in which HTTP runs fine but HTTPS will kill the server.
Re: Google to prioritise secure websites
#30Uh. What if a site doesn't need https? Like if it has just static pages with public content?
"Needing" HTTPS and supporting it are two different things.