<story><title>Securing access to Wikimedia sites with HTTPS by default</title><url>https://blog.wikimedia.org/2015/06/12/securing-wikimedia-sites-with-https/</url></story><parent_chain></parent_chain><comment><author>chatmasta</author><text>User generated content sites are some of the most important that need to implement HTTPS.&lt;p&gt;Consider reddit for example. The entire site is HTTP. That means your ISP can pull up a list of your entire reddit browsing history. They can see every post you read, every comment you wrote, etc. Collectively this data could form quite an accurate picture of a person&amp;#x27;s mental makeup. Is that the kind of data you want floating around?&lt;p&gt;HTTPS encrypts query strings so upstream providers cannot see which specific pages you browse.&lt;p&gt;Of course, HTTPS still shows domain names... but it&amp;#x27;s a start. Next step is DNSSEC for everybody!&lt;p&gt;p.s. Anyone interested going down the rabbithole exploring  mass tracking of individuals, should google &amp;quot;entity mapping llc&amp;quot; and poke around the results...</text></comment>
<story><title>Securing access to Wikimedia sites with HTTPS by default</title><url>https://blog.wikimedia.org/2015/06/12/securing-wikimedia-sites-with-https/</url></story><parent_chain></parent_chain><comment><author>buro9</author><text>This is a great move and has inspired me to think of how I can do this for the sites I run.&lt;p&gt;The problem I have is that I run forums which accept user generated content, and the links in the content are then parsed and embeds are put in.&lt;p&gt;For example, YouTube links have the embedded video put below to the link.&lt;p&gt;YouTube support https, but a lot of smaller sites that offer really useful tools don&amp;#x27;t yet support https. An example is something like &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;www.bikely.com&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;www.bikely.com&lt;/a&gt; which does not support https at all, and yet the embedded maps are common enough on the cycling forums I run.&lt;p&gt;I cannot just proxy via a https domain as these sites usually have JavaScript that require permission to talk to their own domains.&lt;p&gt;I&amp;#x27;ve decided to start emailing all of the 3rd parties to ask that they add https to their site.&lt;p&gt;Almost 40% of my traffic is now over https, and it&amp;#x27;s harder to increase that as every time I try to I receive support complaints about mixed-content warnings, missing content, etc.&lt;p&gt;If you also run a site that has embeds in user generated content, please consider emailing the 3rd parties and explaining why they should move to https.&lt;p&gt;There are only a few things holding back a lot of sites and it&amp;#x27;s no longer the cost of a cert and SSL termination:&lt;p&gt;1) Embedded widgets that are http only today&lt;p&gt;2) Advert widgets&amp;#x2F;scripts that are http only today&lt;p&gt;Those things hold the vast majority of news sites back too. I even checked the Guardian yesterday and no https available. The only news site that was https was The Verge, but I&amp;#x27;m not sure tech news is really news.</text></comment>