0

There were some questions regarding this topic, but none of them discussed if there is some expection, and if http is just enough for some kind of websites.

I've seen lot of school/high school websites with just http, so there was no https link. On this websites there was also no login or something present, so was a let's say normal static kind of website (I did not check it further, maybe there was some hidden link to login and edit the website). Does this kind of website need a https? What is a danger of having just http for this site?

Another example would be a personal website. Imagine you have a website where people can read your info, the projects you were working on and contact details; so no login and nothing. Does this kind of website requires a https connection? Also here, what is dangerous of having just http for this site?

Also this: http://collegeinfogeek.com/
This website is http, but does this website need a https for their purpose?

One more thing that is not clear for me. If there is a login option present on the website, https is highly reccomended. But in the case we use http and we encrypt the login credentials and send the ecrypted data on the server we should be also secure or?

NOTE: I am reffering to "small" websites, not an organization or business website (with bank transactions and so). Just normal site with login possibility.

1

HTTPS is always recommended these days. And generally fairly easy to implement too.

Any webiste that contains sensitive information or any that simply has a login MUST be secured with HTTPS. Othewise, you are sending information in clear text over the Internet which is easily intercepted.

For sites with no login and no sensitive information, HTTPS is perhaps less critical but there are still reasons. The main one being that without it, it is possible for attackers to substitute some of your legitimate content with their own. When using HTTPS, the end-to-end conversation is encrypted and so attacker have no way of intercepting and replacing content.

The other main reason to want HTTPS always is to stop 3rd parties from following what you are reading.

These apply to the website you listed. Although the store part of the site is already secured with HTTPS, the general sections are not, by default, and so may be vulnerable to attack and eavesdropping.

You should note, however, that having a general website only use HTTP is still very common and the risks are generally not that bad.

Note: Try using HTTPS on that website, For me, it completely messed up the formatting. So something is not correctly configured.

Regarding login pages: It is best practice to encrypt the login page not just the actual login dialogue. This ensures that the end-to-end communication is encrypted and it provides visible assurance to the user that you have done the right thing. Never give your login details on a page that isn't using HTTPS. Not for any reason. You probably don't have time to go round checking what the system is doing behind the scenes and it indicates poor understanding and/or practice on the site owners and developers parts.

  • tnx for the great answer. One more question. Imagine I host a website on the local network (e.g. my personal website, info and so) and if I can fisically edit the website on the computer, so I do not need internet connectivity to edit the website. Having just the http, what is the danger? I mean querrying that site, I just get in my browser plain text of the website. You mean that there is a possibility that someone change this plain text (when the server sends me the text) so I get displayed potentially harmful site? – lucidBug Sep 18 '16 at 19:22
  • The only danger there is that you have mistakenly configured the computer so that the website is accessible from the network. Most development web-servers deliberately bind only to localhost so that this can't happen. Otherwise, it really isn't necessary to provide https for local development, it only gets in the way. Of course, if you have malware on the computer then all bets are off anyway. – Julian Knight Sep 18 '16 at 19:27
  • Sry I was not clear. I meant that I host my website locally (available to external). You mean that there is a possibility that when someone querry the website (from external) the answer from my server can be manipulated (since is plain text) so the end user could see potentially harmful website? (e.g. if there was man in the middle, between my server and the user browser, who changed the content) – lucidBug Sep 18 '16 at 19:32
  • Yes, that is correct. Especially if your PC is a laptop and may therefore be on untrusted networks. – Julian Knight Sep 18 '16 at 19:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.