In doing some research regarding SSL, I came across this topic. One of the common suggestions was not to serve content over HTTP. What does that mean from a website development POV? Referencing things like stylesheets with a full https URL? Something else?
It means to always use the SSL layer when serving pages. Links don't need to be absolute, but traffic received on port 80 without SSL should be redirected to port 443 with SSL. The rest of the magic is in avoiding attacks where the user doesn't visit the SSL site first and the redirect is hijacked using something like SSLstrip. That is covered in this question: Options when defending against SSLstrip?
It means that all content and resources should be served over HTTPS (not HTTP). Local scripts, stylesheets, and images should be referenced with a URL that will ultimately load the resource over HTTPS, not HTTP.
One way to achieve this is to make sure that all URLs are absolute and fully qualified, and start with https:.
Alternatively, you can continue to use relative URLs, as long as you verify they will ultimately resolve to a https: URL.
For example, suppose you have a page
I hope this makes sense.
I want to be able to encrypt certain things (like user passwords) but DO NOT WANT to enable any third party verification exploits (CAs have no idea about site content nor user wishes so so what exactly would they be able to verify?). It just opens up a huge security hole in browsers that could be exploited by a rogue CA, nor do I want WASTE resources encrypting PUBLIC content (that makes no sense).
Browser behavior is the problem … and we are still stuck with a mid-90's workaround was probably only intended to be temporary and the security hole opened up in browsers by it now is considered too high a price to pay for many of us.
I am getting very sick of the misinformation being bandied about everywhere regarding SSL and the endless attempts to sneak this exploit into software.
Until the third party verification exploits are removed from browser defaults SSL cannot be considered secure for website use, because the untrusted third party verification opens up a big gaping hole in those browsers that could potentially be abused to frighten your users away!
You get the same encryption with a self signed certificate, but browsers will tell users it is "insecure" - based not on anything on your site, nor anything the user asked for. No, it's just whether you paid someone for a certificate.
Now what would happen if a rogue or corrupt government or corporation took over a CA? (or even a corrupt employee working there)…
Think about it
… its a serious matter!
I've seen plenty of pretty dodgy scammy sites with "valid" certificates out there, and not yet in all these years ever seen those browser warnings happen on anything malicious (always just "expired", self signed, etc). It does not help anyone - people just buy certificates for the browser bling.
The actual encryption is no more or less secure than with a self signed certificate.
That could be abused.