Timeline for Is there ever a good reason _not_ to use TLS/SSL?
Current License: CC BY-SA 3.0
15 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Sep 13, 2014 at 22:43 | comment | added | Ángel | I agree it can be a burden when you get a certificate warning for a site you wouldn't trust too much and it's only used as opportunistic encryption. However, that's a client-side problem. I find a bigger issue when you do want a secure layer and the site doesn't provide it, not even by manually changing the protocol to https (and sometimes it is configured, just not enabled for the page/subdomain). Even if you don't think many people will need TLS for your service/web page, you should provide https as optional if that isn't a big problem for you. | |
| Aug 10, 2014 at 12:16 | comment | added | Alice | @Christian Just because users value their privacy doesn't mean it matters. | |
| Aug 10, 2014 at 10:28 | comment | added | Dominic Cronin | Christian - if you have to justify the budget, you will make these judgments. For a normal website, your visitor's desire for privacy is their own concern. You may care enough about how they perceive you to invest in extra security, or you may not. | |
| Aug 10, 2014 at 9:56 | comment | added | Christian | The fact that you don't value your privacy doesn't mean that you can be confident that you don't have users who value their privacy. | |
| Aug 10, 2014 at 5:40 | comment | added | Dominic Cronin | It's a reasonable answer to the question you asked, especially considering your stipulation of "doing it right". Perhaps your question should reflect your view that everything should be secured. | |
| Aug 10, 2014 at 5:30 | comment | added | Dominic Cronin | Naftuli - I haven't overlooked it. I just don't place as high a value on it as you. Most sites offer content which is not critical. If I turn up half an hour late to the village cricket match because some prankster has interfered with my connection to the cricket club's site, the world won't come to an end. Your question was whether there's ever a good reason not to secure the traffic. My answer is: yes, sometimes the benefits are less than the costs. | |
| Aug 10, 2014 at 4:22 | comment | added | Naftuli Kay | You have overlooked something critical which TLS provides to clients: privacy. An adversary can see that you've accessed a certain IP, but cannot see the contents or modify them. As a user, I want this for EVERY site I visit. It's terribly simple to run a MITM and rewrite web pages as you see fit. TLS protects users from wire-tapping and tampering. | |
| Aug 10, 2014 at 1:19 | comment | added | Dominic Cronin | Christian - that's like saying I should put a lock on my garden gate because someone might follow the postman and decide to mug him because he visited on a Tuesday. There are more appropriate defences than blanket transport security. A certain amount of paranoia is justified, but there really are plenty of situations where plain-old http (or whatever other protocol) is fine. Even with TLS/ssl, your browsing patterns are still visible, unless you are using something like tor, in which case, you've only moved the problem. | |
| Aug 9, 2014 at 23:48 | comment | added | Christian | Not everyone who uses the website is a member of the target audience. It's also not trivial to understand what someone can do with knowledge of browsing habits.An attacker can build personality profiles through complex correlations that you simply don't see when you think about your website. | |
| Aug 9, 2014 at 22:02 | comment | added | Dominic Cronin | Most websites know exactly what their target audience is. | |
| Aug 9, 2014 at 20:14 | comment | added | Christian | The can assess their security needs, but not the needs of the visitors especially if the owner of the website doesn't have much information about the visitors. | |
| Aug 9, 2014 at 19:52 | comment | added | Dominic Cronin | Christian - I don't know in what sense you are using "you never know". Are you saying that more security is always better? The essence of this question is about whether https is always better. I'm saying that a web site owner /can/ assess their security needs, and that for many/most web sites it doesn't help. My house has a lock on the front door, but not on the garden gate. | |
| Aug 9, 2014 at 18:39 | comment | added | Christian | You never know beforehand what kind of information might be critical. | |
| Aug 9, 2014 at 9:12 | review | First posts | |||
| Aug 9, 2014 at 9:21 | |||||
| Aug 9, 2014 at 9:08 | history | answered | Dominic Cronin | CC BY-SA 3.0 |