Hacker News new | ask | show | jobs
by ukuina 1146 days ago
I have not understood the need to force SSL on content that needs no verification.
2 comments

Yes and no. It's more like flossing than wearing a seatbelt. The html tags won't fall out if you use http:// over port 80. It's not nice to end users in that it permits eavesdropping and content modification of website traffic in the clear by anyone in the network path. The assumption of http:// is that "pamphlets for the public" don't require privacy, confidentiality, and nonrepudiation for other users such as downloading software sources &| binaries or exchanging secret PII. The post-Snowden/-PRISM world opted to deploy https:// ubiquitously as both a virtue signal and technical defense to various problems inherent to using port 80.
Why does it not need verification? 3rd parties can a) replace the real content with lies, or more likely, b) inject it with 3rd-party ads. (this is not theoretical! *) c) inject crypto-mining/other malicious javascript into it. Outside of that though, d) Other people can see what you're looking at. Even if you don't take privacy seriously, you can at least understand that some people do, and would like their viewing habits to remain private.

* https://www.thesslstore.com/blog/third-party-content-injecti...

My letterbox can be a) trivially broken into b) knocked over as it isn't concreted c) stuffed with dog poo.

These risks however aren't a major concern for me, and people who choose to send me mail don't assume security or deliverability.