2

I've seen a lot of websites by security teams & companies which use HTTP instead of HTTPS. I'm using HTTPS Everywhere and have found even some medium-big groups not using HTTPS. I'm a noob at cybersecurity so I'm not knowledgeable about such details.

Why are security companies that specialize in cybersecurity using the less secured HTTP instead of HTTPS? Is this a big issue to be concerned about, and what does it say about the "quality" of those companies?

  • If there is no sensitive data that must be transferred to another medium, then SSL is not needed. – tungsten Aug 22 at 14:20
  • 1
    If HTTPS should be used or not does not depend on what company is providing the content but on the content itself. Still, it can usually be expected from security providers that they offer https if possible. Given that you see "a lot of websites by security teams & companies" which use HTTP it would be interesting if you can provide some examples so that we have something more substantial as the base of your question. – Steffen Ullrich Aug 22 at 14:30
  • The reason why is due to laziness. – john doe Aug 22 at 16:11
  • Daily reminder that Heartbleed did not affect servers that did not serve HTTPS. – user Aug 22 at 20:38
  • Concur some examples would be good. Except for software package repositories where the data is nonsecret, usually duplicated (mirrored), and internally signed, the last laggard I recall was NIST (specifically CSRC) and they got with the program about 2 years ago as I recall. – dave_thompson_085 Aug 23 at 9:15
2

In this day and age, plain HTTP should not be used at all. Period.

This may be a radical standpoint, but all the reasons that have been stated over the years just don't matter anymore. There is just no good reason to not use HTTPS.

I don't do anything confidential, so my site doesn't need HTTPS.

Any attacker with Man-in-the-Middle capabilities can modify your site to include malicious code. Not using HTTPS endangers your end users.

HTTPS has such high overhead. My servers would fry!

No, this is an urban myth. The site "Is TLS fast yet?" dismantles this myth in detail. The overhead required for TLS is negligible.

And just on a side note: The performance impact for your users is magnitudes higher when you decide to include jQuery to add a class to a <div> as if you were to enable TLS.

But certificates are expensive! I'm just a private person doing a personal homepage!

Certificates are absolutely free from Let's Encrypt.

It's so difficult. There's like private keys and certificates and all those things and I'm confused.

Certbot automatically generates keys, certificate signing requests, takes care of validation and your server configuration.

All you have to do is type the following:

sudo certbot --apache

And if you use apache, Certbot has now successfully added your certificate.

But why do big companies still not use HTTPS if it's so easy?

Because some companies still firmly believe in these myths. Aside from that, their infrastructure may depend on ancient hardware, back then when computers were mechanical and debugging meant pulling literal insects out of the relays. Okay, maybe not that ancient, but still pretty old.

Lots of that older software doesn't work well with modern cryptography. While technically it may be possible to solve this, the budgets of IT teams, both in terms of time and money, is limited. And if they have to choose between investing the time to get HTTPS running on their website, or setting up an internal web application that the vast majority of employees desperately need, their priorities may be elsewhere.

  • Completely agree with this answer - if you're not using HTTPS in 2019 you might as well write "we don't care about your PII" in a large <blink> tag – Jenessa Aug 22 at 15:54
  • Can you name some of the technical problems that may occur when trying to implement HTTPS as you said? Doesn't have to be exhaustive, I just wanna look some up. – John Zhau Aug 24 at 0:51
  • @JohnZhau Some old legacy appliances like WAF's may not support HTTPS, so it becomes more difficult to implement. Another problem may be certificate and key management. – MechMK1 Aug 24 at 12:19

Not the answer you're looking for? Browse other questions tagged or ask your own question.