Timeline for Should we force user to HTTPS on website?
Current License: CC BY-SA 3.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 6, 2012 at 15:57 | comment | added | Brendan Long | Maybe I'm out of place by thinking that when a customer trusts you with personal information (including passwords which are almost guaranteed to be used on other websites), then you should protect it. If you want to do that, then there's no such thing as enforcing HTTPS on some pages. It's all-or-nothing. If you want to protect your users at all, you need to be all HTTPS. | |
| Nov 6, 2012 at 9:59 | comment | added | GdD | Using words like should, and must may lead you to use security strategies that are unnecessary, and incompatible with your business. Security is a business enabler, not an end in itself, and it's important to keep that in mind. | |
| Nov 5, 2012 at 21:38 | comment | added | Brendan Long | If your website has user accounts, you should serve the whole thing over HTTPS. Otherwise, an attacker could replace your "login" links with an insecure version. Some people may notice, but most won't. | |
| Nov 5, 2012 at 16:57 | history | edited | GdD | CC BY-SA 3.0 |
elaborated
|
| Nov 5, 2012 at 16:27 | history | answered | GdD | CC BY-SA 3.0 |