Hacker News Reader

Comment by _uhtu | Hacker News Reader

> HTTPS has been around since 1996

A blog post about spending several years updating to a protocol that's been around for 2 decades and has been standard for full sites for years. This makes me feel like anyone who has an account on BBC should be afraid of their security practices. Calling a plaintext password leak from BBC right now.

EDIT: People are taking this comment more seriously than I intended. I don't actually think you should distrust BBC's security practices because of this, but I do feel that major websites should have side-wide SSL by now. It is clear that a lot of people below me disagree with that, that's okay, I'm glad I spawned a debate here.

View on HN

Calling FUD on your comment.

It hasn't been "standard on full sites for years", and still isn't now. Only recently with the 'HTTPS everywhere' move has the idea that public sites with no authentication should support HTTPS. And even now, that's not a universally supported opinion, because of its effect on caching.

The BBC has used HTTPS on pages with forms that submit secure data, as has been the historic standard.

Moving a site as massive as the BBC, which spans multiple domains and subdomains and has millions of pages is a big task. Note how you can still see news articles from the late 90s at the same URL. So, yeah, I can understand why writing a blog post about it is worthwhile.

Can you point out some other major sites used by the general public which have spent the last few years without site-wide SSL to back up your claim?

I can do better than that - I can give you a report published by Google in March 2016 which listed lots of them.

https://www.google.com/transparencyreport/https/grid/

For example, the following are all in the world's top 100 websites and none of them support any form of HTTPS. The link includes quite a few more.

* alibaba.com

* ask.com

* ask.fm

* baidu.com

* cnet.com

* cnn.com

* dailymail.co.uk

* ebay.com

* globo.com

* go.com

* goal.com

* goo.ne.jp

* imdb.com

* live.com

* mirror.co.uk

* naver.jp

* nytimes.com

* onet.pl

* pornhub.com

* telegraph.co.uk

* uol.com.br

* weibo.com

* wikia.com

* wikihow.com

* wp.pl

* yahoo.co.jp

* yelp.com

* youporn.com

That's scary honestly. Thanks for sharing at least.

Washington Post. Buzzfeed. The Guardian.

New York Times still dosent have HTTPs.

Their traffic is too high for them to afford it (and probably wouldn't outweigh the SEO uplift)

Can I ask you why you say it would be too high for NYT to afford it, when many companies with significantly more traffic have site-wide TLS?

If your examples are Google or Amazon, then those have profits several orders of magnitude bigger than the likes of NYT.

I am actually -1 on this idea. They should be able to afford terminating SSL on the load balancer end. It doesn't change the architecture for as long as the load balancer terminates the traffic. Securing HTTPS internally is an expensive move. CPU wise has always been an argument (or more like an excuse). If your load balancer is doing computation other than forwarding requests and decryption SSL session, you should double check your architecture. If small startup will millions of views can sustain SSL traffic, why not NYT? Most their traffics are just serving static files and results are usually cached anyway.

Instead, the burdens are on testing and developing the migration. For example, they'd have to inventory and edit everywhere they use http:// (hardcoding the scheme in your front-end code) instead of //. Furthermore they have to support third-party ad networks deliver active scripts (like javascript) over HTTP. Having HTTP while on HTTPS will create mixed content warning and for active contents browsers will block these violations immediately, thus breaking the website.

To me, the decision of not migrating to HTTPS because of infrastructure capacity is always a myth. Someone has to prove that with data.

The most commonly cited answer I've seen for these kind of questions hasn't been the cost of serving HTTPS but rather the delays in getting the ad networks to support HTTPS. Some sites reported that they had fewer bids (and thus lower revenue) for ads on HTTPS pages, which is something I'm sure the NYT management watches very closely.

MailOnline. SSL would just cost too much in Akamai billing. Otherwise they'd do it straight away for the SEO uplift.

> It hasn't been "standard on full sites for years", and still isn't now.

I'd estimate about 75% of the time I'm on an HTTPS website.

> The BBC has used HTTPS on pages with forms that submit secure data, as has been the historic standard.

This is insecure as the HTTP page can redirect to a malicious HTTPS page from a different domain.

I agree with the need for the BBC to do this. But I disagree with the OP's suggestion that, just because it took them until now to finish doing it, that I should be "afraid of their security practices".

The "afraid of the security practices" was more of a joke than an actual serious jab. But I do still hold that site-wide TLS should be default by all major websites at this point in time.

Yup. Until very recently, you did most of your shopping on Amazon.com using unsecure HTTP, right up until you clicked Checkout. Only recently did they move all of the product browsing over to HTTPS.

Reply on news.ycombinator.com