Hacker News Reader

> It hasn't been "standard on full sites for years", and still isn't now.

I'd estimate about 75% of the time I'm on an HTTPS website.

> The BBC has used HTTPS on pages with forms that submit secure data, as has been the historic standard.

This is insecure as the HTTP page can redirect to a malicious HTTPS page from a different domain.

I agree with the need for the BBC to do this. But I disagree with the OP's suggestion that, just because it took them until now to finish doing it, that I should be "afraid of their security practices".

The "afraid of the security practices" was more of a joke than an actual serious jab. But I do still hold that site-wide TLS should be default by all major websites at this point in time.

Reply on news.ycombinator.com