<story><title>Supporting Let’s Encrypt, the nonprofit making HTTPS free for all</title><url>https://blog.1password.com/supporting-lets-encrypt/</url></story><parent_chain><item><author>NikolaNovak</author><text>Love Let&amp;#x27;s Encrypt, Like 1password, support&amp;#x2F;use them both.&lt;p&gt;But I&amp;#x27;m still unconvinced that every single one of those last remaining 15% of websites &lt;i&gt;must&lt;/i&gt; be transitioned to HTTPS.&lt;p&gt;I have personal websites that are open, public, non-controversial, simple. I like that you can curl or wget them without mucking about with certs and that you can view them using anything and everything vaguely browsery ever made. I feel moving to HTTPS subtracts value, at least to me, and I&amp;#x27;m the owner.&lt;p&gt;Not to get all grouchy old geezer, but I don&amp;#x27;t feel &lt;i&gt;every&lt;/i&gt; single public open simple textual website must be encrypted. Where am I wrong &amp;#x2F; what am I missing?  (While understanding there&amp;#x27;s a mathematical &lt;i&gt;world of difference&lt;/i&gt; between statements &amp;quot;Most &amp;#x2F; 99% of websites should be encrypted!&amp;quot; and &amp;quot;All &amp;#x2F; 100% of websites should be encrypted!&amp;quot; :)</text></item></parent_chain><comment><author>tialaramex</author><text>The intuitive properties you expect from HTTP actually aren&amp;#x27;t delivered and can&amp;#x27;t be delivered, except over HTTPS.&lt;p&gt;A lot of people focus on the &lt;i&gt;confidentiality&lt;/i&gt; element of TLS. &amp;quot;Clearly I don&amp;#x27;t need for it to be secret that I looked at the Wikipedia entry for Napoleon (the 1995 movie, not the famous guy)&amp;quot;.&lt;p&gt;But TLS bundles together three things and if you need &lt;i&gt;any&lt;/i&gt; of them you can&amp;#x27;t have them with plain HTTP. You get confidentiality, but you also get integrity and authentication.&lt;p&gt;That means when you curl &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;foo.example&amp;#x2F;something&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;foo.example&amp;#x2F;something&lt;/a&gt; we can promise you that the result is the resource &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;foo.example&amp;#x2F;something&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;foo.example&amp;#x2F;something&lt;/a&gt; - maybe that&amp;#x27;s not what you actually wanted, maybe it&amp;#x27;s full of lies or worse, but it &lt;i&gt;is&lt;/i&gt; what you asked for and it &lt;i&gt;is&lt;/i&gt; what you get. With plain HTTP all bets are off, anybody can interpose and present anything else to you.&lt;p&gt;If it&amp;#x27;s OK if you just get anything and not the article from Wikipedia, why even look at Wikipedia at all? You could make up whatever you want, it&amp;#x27;s a black-and-white movie about a dog who ruled France and then went into space, and it was the #1 grossing movie in every country for six years.</text></comment>
<story><title>Supporting Let’s Encrypt, the nonprofit making HTTPS free for all</title><url>https://blog.1password.com/supporting-lets-encrypt/</url></story><parent_chain><item><author>NikolaNovak</author><text>Love Let&amp;#x27;s Encrypt, Like 1password, support&amp;#x2F;use them both.&lt;p&gt;But I&amp;#x27;m still unconvinced that every single one of those last remaining 15% of websites &lt;i&gt;must&lt;/i&gt; be transitioned to HTTPS.&lt;p&gt;I have personal websites that are open, public, non-controversial, simple. I like that you can curl or wget them without mucking about with certs and that you can view them using anything and everything vaguely browsery ever made. I feel moving to HTTPS subtracts value, at least to me, and I&amp;#x27;m the owner.&lt;p&gt;Not to get all grouchy old geezer, but I don&amp;#x27;t feel &lt;i&gt;every&lt;/i&gt; single public open simple textual website must be encrypted. Where am I wrong &amp;#x2F; what am I missing?  (While understanding there&amp;#x27;s a mathematical &lt;i&gt;world of difference&lt;/i&gt; between statements &amp;quot;Most &amp;#x2F; 99% of websites should be encrypted!&amp;quot; and &amp;quot;All &amp;#x2F; 100% of websites should be encrypted!&amp;quot; :)</text></item></parent_chain><comment><author>MaxBarraclough</author><text>A fair question deserving a real answer, rather than downvotes.&lt;p&gt;1. HTTPS prevents ads&amp;#x2F;trackers&amp;#x2F;malware being injected into the page by unscrupulous ISPs. Man-in-the-middle attacks of this sort really have happened, [0] and remember that the browser itself may have exploitable security vulnerabilities.&lt;p&gt;2. Modern browsers will (rightly) warn users not to trust the site. This makes the site look bad.&lt;p&gt;3. Some fancy browser features are disabled if you use unencrypted HTTP. Likely irrelevant for a static site though.&lt;p&gt;4. Privacy matters. A medical website, or indeed Wikipedia, should prevent a snooping ISP from finding out you have been reading about an embarrassing condition. This is similar to the way librarians are extremely protective of their loan records [1]. Netflix use HTTPS for their streams, for the same reason (it does nothing to aid their DRM, it&amp;#x27;s purely about privacy) [2].&lt;p&gt;5. Let&amp;#x27;s turn the tables and ask why you &lt;i&gt;wouldn&amp;#x27;t&lt;/i&gt; use HTTPS for a public-facing web server. There are just 3 reasons:&lt;p&gt;* Reduced admin overhead not having to bother with certs&lt;p&gt;* It enables caching web proxies, which is only relevant if you&amp;#x27;re running a serious distribution platform like Steam, or a Linux package-management repo [3]&lt;p&gt;* Better support for very old devices, such as old smartphones in the developing world&lt;p&gt;[0] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;doesmysiteneedhttps.com&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;doesmysiteneedhttps.com&amp;#x2F;&lt;/a&gt;&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.theguardian.com&amp;#x2F;us-news&amp;#x2F;2016&amp;#x2F;jan&amp;#x2F;13&amp;#x2F;us-library-records-purged-data-privacy&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.theguardian.com&amp;#x2F;us-news&amp;#x2F;2016&amp;#x2F;jan&amp;#x2F;13&amp;#x2F;us-library-r...&lt;/a&gt;&lt;p&gt;[2] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;arstechnica.com&amp;#x2F;information-technology&amp;#x2F;2015&amp;#x2F;04&amp;#x2F;it-wasnt-easy-but-netflix-will-soon-use-https-to-secure-video-streams&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;arstechnica.com&amp;#x2F;information-technology&amp;#x2F;2015&amp;#x2F;04&amp;#x2F;it-wa...&lt;/a&gt;&lt;p&gt;[3] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;web.archive.org&amp;#x2F;web&amp;#x2F;20200615045650&amp;#x2F;http:&amp;#x2F;&amp;#x2F;whydoesaptnotusehttps.com&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;web.archive.org&amp;#x2F;web&amp;#x2F;20200615045650&amp;#x2F;http:&amp;#x2F;&amp;#x2F;whydoesapt...&lt;/a&gt;&lt;p&gt;(Based on an old comment of mine at &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=22147858&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=22147858&lt;/a&gt; )</text></comment>