I've seen a lot of websites by security teams & companies which use HTTP instead of HTTPS. I'm using HTTPS Everywhere and have found even some medium-big groups not using HTTPS. I'm a noob at cybersecurity so I'm not knowledgeable about such details.
Why are security companies that specialize in cybersecurity using the less secured HTTP instead of HTTPS? Is this a big issue to be concerned about, and what does it say about the "quality" of those companies?
This may be a radical standpoint, but all the reasons that have been stated over the years just don't matter anymore. There is just no good reason to not use HTTPS.
I don't do anything confidential, so my site doesn't need HTTPS.
Any attacker with Man-in-the-Middle capabilities can modify your site to include malicious code. Not using HTTPS endangers your end users.
HTTPS has such high overhead. My servers would fry!
No, this is an urban myth. The site "Is TLS fast yet?" dismantles this myth in detail. The overhead required for TLS is negligible.
And just on a side note: The performance impact for your users is magnitudes higher when you decide to include jQuery to add a class to a <div> as if you were to enable TLS.
But certificates are expensive! I'm just a private person doing a personal homepage!
Certificates are absolutely free from Let's Encrypt.
It's so difficult. There's like private keys and certificates and all those things and I'm confused.
Certbot automatically generates keys, certificate signing requests, takes care of validation and your server configuration.
All you have to do is type the following:
sudo certbot --apache
And if you use apache, Certbot has now successfully added your certificate.
Because some companies still firmly believe in these myths. Aside from that, their infrastructure may depend on ancient hardware, back then when computers were mechanical and debugging meant pulling literal insects out of the relays. Okay, maybe not that ancient, but still pretty old.
Lots of that older software doesn't work well with modern cryptography. While technically it may be possible to solve this, the budgets of IT teams, both in terms of time and money, is limited. And if they have to choose between investing the time to get HTTPS running on their website, or setting up an internal web application that the vast majority of employees desperately need, their priorities may be elsewhere.
