Consider disabling HTTPS auto redirects

26 点作者 bradley_taunt将近 3 年前

21 条评论

This is really misleading and potentially dangerous. Details:* Even on static sites, HTTPS prevents a MITM from telling what pages you're reading, or introducing falsehoods into the content. It's not "overuse" to use HTTPS there.* I don't know how the author's server is set up, but a 1-second increase in page load time isn't consistent with load times I've ever measured anywhere else. In fact, there's a lot of HTTPS pages where the total load time is less than what's claimed as the difference here.* If you care about sustainable technology, you should be demanding that Apple provide updates for hardware longer, or open-source everything so that the community can. Whether or not the sites you want to visit use HTTPS, using the Internet from a system years behind on security patches is a really bad idea, and not something you should optimize for.* The specific suggestion of disabling the redirect is exactly equivalent to a MITM attacker running sslstrip, so you're doing a big piece of the bad guy's job for him.

评论 #31895827 未加载

评论 #31897030 未加载

评论 #31895798 未加载

评论 #31895582 未加载

评论 #31895771 未加载

SquareWheel将近 3 年前

Not a compelling argument in the least. MITM still means ISPs can track and inject ads, regardless of how static the content is on your website. And the performance argument is completely invalid because it's only measuring total bytes, and doesn't consider HTTP/2 multiplexing.> It should be mentioned that my personal website is also plain text based and tiny. Imagine the impact of a blog article or research paper with significantly more content.The larger the website, the greater the improvement from using HTTP/2 (which requires TLS). And it doesn't take much data at all to offset that TLS lookup.This post is justifying bad behavior. The only sites that can afford to remain http are neverssl.com and local development.

评论 #31896247 未加载

davewritescode将近 3 年前

One thing that these types of articles always miss is that HTTPs isn't just there to protect user data being submitted to your website. It's also there to make sure that the data you're looking at wasn't modified by a 3rd party without your consent.The fact that someone technical has missed it this is a really good argument for redirecting users from HTTP to HTTPS.

评论 #31895605 未加载

jillesvangurp将近 3 年前

I think there are few excuses left for not having https on your website. Having the option of having an http only variant of your website should likewise not be a thing. A redirect is better than a not found error. IMHO those are the two valid responses for a public http website (go away, or go here instead).As for "updated browsers", anything that doesn't support https (or redirects) in 2022 is not fit for use on the modern internet. Most of the web would in any case be unusable with such a browser already. And essentially everything that shipped in the last 20 years or so would be able to deal with this (with the exception of handling newer TLS versions perhaps). You'd be well advised to not use a browser that hasn't been updated for that long.If somehow you are using such a browser (why?!), you might want to fix that ASAP. Meanwhile, I'll blindly assume the intersection of those users and this audience (hacker news) is extremely small to non existent. If that intersection exists at all, it's probably for some esoteric reasons that have nothing to do with an inability to fix the actual problem (like fixing your browser setup) and is by choice rather than by circumstances. Either way, your problem to solve and not something to waste energy on for website maintainers looking to do the right thing.

babypuncher将近 3 年前

That is a pretty weak argument for why we should sacrifice privacy. We should continue moving in the opposite direction. Ideally, within 5 years, browsers should send up warning flags whenever the user hits a website that doesn't use HTTPS.They had to go back 20 years to find a browser that does not support TLS. Software that old is going to have other fundamental problems accessing the modern web. The amount of work necessary to make every website actually work on a browser that old is far, far greater than just supporting HTTP.

batch12将近 3 年前

So the argument is https has too much overhead and excludes those who cant use updated browsers? Unless I missed it, the article doesn't discuss mitm, nonrepudiation or censorship/privacy concerns.

评论 #31895549 未加载

评论 #31895540 未加载

评论 #31895507 未加载

JoshTriplett将近 3 年前

> Let’s take an example of the Powerbook G4, which was released in 2002.> So why force users to toss away perfectly viable devicesIf it can't do secure connections, it's not a perfectly viable device.

tarasglek将近 3 年前

There are a lot of ISPs, even consumer wifi gateways that mess with unencrypted traffic. HTTPS is the only way to ensure that the data served is what the user received.

评论 #31895746 未加载

remram将近 3 年前

Using HTTPS by default has obvious security benefits, but it's not clear we need a redirect to implement it. We could have leveraged the Alt-Svc header for this instead, which is meant specifically for this. This would allow modern browsers to use HTTPS without preventing older browsers which want to use HTTP from doing so (at their own risks).

评论 #31896211 未加载

评论 #31896064 未加载

sshine将近 3 年前

> increases it’s overhead by almost 100%.3.8/2.9 kB is a 31% increase.1.16/0.62 s is an 87% increase.But okay, let's round up to 100%.The article is citing a page that counter-argues this:> Sites with modern servers load faster over HTTPS than over HTTP because of HTTP/2.> <a href="https://istlsfastyet.com/" rel="nofollow">https://istlsfastyet.com/</a>---> But what about sites like <a href="https://doesmysiteneedhttps.com" rel="nofollow">https://doesmysiteneedhttps.com</a>? While this website makes a few valid points, it still relies heavily on “fear tactics” that honestly don’t apply for the vast majority of users. It’s overkill.Sorry, but not good enough.1. "a few valid points": you avoid making your visitors liable in oppressive environments (employers, regimes), you avoid very real content injection (commercial or malicious), and you give the visitor a way to know that content wasn't tampered. That's a few valid points. (The rest are counter-arguments.)2. "fear tactics": not true. Protecting the integrity of your visitors and your content is nurture, not fear.3. "don’t apply for the vast majority of users": by making HTTPS standard at practically no cost, you make it work for those for whom it matters. Just because I feel safe on Hacker News doesn't mean that any visitor who goes here will be treated fairly by reading my message.

bugmen0t将近 3 年前

Pervasive traffic monitoring is an attack and it is an attack being carried out in massive scale. I believe HTTPS is the most meaningful and available method out there to stop this attack.If your website does not support using HTTPS you are an accomplice in pervasive monitoring.

freitasm将近 3 年前

Article suggests to use Httpseverywhere but it is being deprecated <a href="https://www.eff.org/deeplinks/2021/09/https-actually-everywhere" rel="nofollow">https://www.eff.org/deeplinks/2021/09/https-actually-everywh...</a>

noodlesUK将近 3 年前

I pretty much wholeheartedly disagree with this. HTTPS provides confidentiality, but it also provides integrity, which is arguably much more important for many cases. If you’re browsing around on an older (perhaps unpatched) machine, a plaintext HTTP website can easily have malware embedded in it by another person on the wifi network (with ARP spoofing or whatever). It can also have incorrect links (see sslstrip) that impersonate other websites. It used to be that a major UK bank didn’t use HTTPS for their homepage, only for their online banking application. You would probably think this is fine, but it’s trivially easy to replace the link to said online banking application with one that MITMs you.Requiring HTTPS also provides another benefit, which is that it stops downgrade attacks. If your site is available in plaintext, I can just block access to the secure version in order to do my nefarious business. The internet is a nasty place these days.

strogonoff将近 3 年前

Plain HTTP is synonymous with trust. In an ideal world where no one would snoop or mangle responses, it should be enough.In our still-imperfect world with potential MITM attacks, sometimes that trust is not warranted. However, one still should be able to choose to trust own connection. I don’t want this choice to be made for me with no way to appeal.

评论 #31896544 未加载

toast0将近 3 年前

One way to manage this is to use HSTS to send modern browsers to https and leave older browsers to whatever they want.a) put your content on www.example.com because it's importantb) redirect <a href="http://example.com" rel="nofollow">http://example.com</a> to <a href="https://example.com" rel="nofollow">https://example.com</a> because this is required for HSTS preloading. And from there to <a href="https://www.example.com" rel="nofollow">https://www.example.com</a> because it's important that your contentful urls be at a domain that isn't going to redirect.c) serve hsts preload headers at least for <a href="https://example.com;" rel="nofollow">https://example.com;</a> serve hsts headers for at least <a href="https://example.com/favicon.ico" rel="nofollow">https://example.com/favicon.ico</a>d) set your favicon on all pages to <a href="https://example.com/favicon.ico" rel="nofollow">https://example.com/favicon.ico</a>e) submit to the hsts preloading sitef) remove redirects from http to https on wwwModern browsers with preload built after your site is added would always use https. Modern browsers without the preload will load whatever the first page they hit as http, but pickup the preload from the favicon and future page loads will be https. Resources from the first load will likely be http, depending on favicon loading timing. There's no additional MITM risk for modern browsers, because a MITM could avoid your redirect if an http load is attempted just as well as they could mess with your HTML.Older browsers can still go to the http version, although inbound links are likely to be https, because people like to cut and paste from the URL bar, and most people are going to have a modern browser with your site preloaded. Users of older browsers would need to edit the url in the URL bar, a skill they'd likely rapidly develop.

jenny91将近 3 年前

Confidentiality should be on by default: not just when you enter your credit card details.

elverado将近 3 年前

Most modern browsers display a danger warning icon on classic HTTP addresses? Or am I mistaken?

评论 #31895745 未加载

maerF0x0将近 3 年前

IMO it's better to close port 80 entirely because many clients will end up sending unencrypted headers and rely on the redirect, not realizing they've exposed themselves.<pre><code> ===> HTTP GET /your_api Host: passwordleaker.com Authorization: Bearer 12312312321 <=== HTTP/1.0 302 Found Location: https://passwordleaker.com/your_api </code></pre> (but note it's too late)

评论 #31896504 未加载

评论 #31895991 未加载

theandrewbailey将近 3 年前

> By using HTTPS my website increases it’s overhead by almost 100%. It should be mentioned that my personal website is also plain text based and tiny. Imagine the impact of a blog article or research paper with significantly more content.An extra kilobyte. Wow. Such data transfer. What a dealbreaker.No HTTPS means worse performance, because HTTP 2.0 requires it. HTTP 1.x doesn't have connection multiplexing. When I moved my blog to HTTP 2.0, I noticed that it loaded faster, even when on the same LAN as the server.> Helpful Tips:> If users are nervous of links set in standard <a href="http://" rel="nofollow">http://</a> format, they can add s themselves or better yet, use a browser extension like HTTPS Everywhere (highly recommend)HTTPS Everywhere won't be supported beyond 2022: <a href="https://www.eff.org/deeplinks/2021/09/https-actually-everywhere" rel="nofollow">https://www.eff.org/deeplinks/2021/09/https-actually-everywh...</a>

评论 #31896116 未加载

dingosity将近 3 年前

meh. the reason i like HTTPS is it makes it difficult for unscrupulous ISPs to insert ads and code into my pages. and yeah. bad guys inserting nefarious cookies as well.it's great the poster hasn't had to deal with such problems, and they're certainly not universal. but they're common enough to just do HTTPS and not worry about it.also... https is adding half a second to load times? pretty sure this is what QUIC and HTTP/3 were designed for. or move your content to akamai or cloudfront or cloudflare or whatever CDN you're comfortable with.

sebazzz将近 3 年前

Say what you will, but HTTPS did kill http compression.

评论 #31900129 未加载