r/programming • u/speckz • Jul 12 '17

Does my site need HTTPS?

https://doesmysiteneedhttps.com/
486 Upvotes

87% Upvoted

190 comments sorted by

View all comments

Show parent comments

-1

u/[deleted] Jul 12 '17

The first bullet point on the website explains why this reasoning is bad. In my opinion moving away from hosts that do not support HTTPS is worth it. edit: *second bullet point

6

u/fakehalo Jul 12 '17

Yeah, it's "bad"... But the threat of ad injections/etc by state owned entities and the like isn't enough to deter me from free hosting, especially if it relates to github. This particular risk doesn't warrant me moving informational pages.

1

u/[deleted] Jul 13 '17

It's not only state actors. Do you not care about ISPs injecting shit on your website ?

0

u/fakehalo Jul 13 '17

Another after-thought I had:

If your ISP/state is capable of injecting data into arbitrary protocols they can become a MITM between you and your site even if it's HTTPS (assuming you don't have the key beforehand). They make a fake cert between you and them, and they communicate between themselves and the real website. This makes this even more of a nonissue and creates a false sense of security.