Hacker News new | ask | show | jobs
by superkuh 1980 days ago
HTTPS Everywhere (client side option) is great. HTTPS only (server side option) is not.
1 comments
naf77 1980 days ago
HTTPS only is a "Fail Closed" system, ie it blocks access in case of failure. This is safe for the general population.

HTTPS/HTTP mixed support is a "Fail Open" system, ie it allows (unencrypted) access in case of failure. This is unsafe for the general population, see QUANTUM (above).

link
superkuh 1980 days ago
You can argue for wearing a bulletproof vest at home if you're an iraqi nuclear scientist. But for most people it doesn't make sense and does more harm than good.

In the same way, HTTPs only, *requiring* a system that "fails open", is bad for the general population. HTTP+HTTPS, yes, definitely. HTTPS only, no, only for sites and contexts where the rigid security is justified.

link
patmorgan23 1980 days ago
Yes context is key. Its ok for wikipedia to fail back to HTTP but not for bank.
link