Here's Why Your Static Website Needs HTTPS

What people said

sbmthakur · 2020-07 · Strong recommendation

This was the article that convinced me to be HTTPS everywhere (well maybe in 99.99% cases if not everywhere). The linked video is a must watch to those who still doubt HTTPS[0]. The mention of China's Great Cannon was particularly eye-opening[1]. 0. [VIDEO] 1. [LINK]

Read the original HN comment ↗

DigitalNoumena · 2023-08 · Recommendation

[LINK] The whole video is great, but particularly this: [VIDEO] [LINK] There are a lot of arguments about why, even non-secret data connection need encryption. The first and most obvious is that not doing so immediately puts a target on the encrypted data. By no means an expert but to me it seems like an oversight not to.

Read the original HN comment ↗

_Nat_ · 2021-06 · Reference

The reason I'd advocate in more public settings is that things ought to be secure-by-default, and that adopting security only upon realizing its necessity is a hazard-prone policy that constantly backfires. But for a specific example of something that could go wrong: someone could inject malicious content into a non-secure page. The original content might be plain-text, but a man-in-the-middle can still inject whatever they like regardless. As a common example of a simple attack: an attacker could man-in-the-middle people who connect to a nearby wireless network. Notes: 1. There're a bunch of ways that an attacker could get people to connect to their network. Examples: spoofing a legitimate network; setting up a password-less network; putting up a poster falsely advertising the SSID/pass to a network that falsely purports itself to be official; they're an actual employee of the establishment and just compromise the legitimate network; they're a remote-hacker who's exploited a vulnerability in the router. 2. The attacker could do lots of random stuff. Examples: they could inject malicious code; they could inject misinformation to facilitate scamming someone; they could insert ads; steal CPU-time/electricity for crypto-mining; they could just put gross porno on everyone's phone in a restaurant as a troll. Or something else. Or multiple things. 3. The original site being just plain-text doesn't really matter; the attacker can replace the entire thing without even contacting the

Read the original HN comment ↗