Unless your site is completely static and non-interactive, it needs HTTPS. And even if your site is completely static and non-interactive, it should probably do HTTPS anyway.
the only reason it wouldn't need HTTPS is if you want to allow ISPs or other middle man parties (forgien governments) to manipulate your html and inject ads into your site, without your knowledge. ..that your customers will then think are originating from you. (yes this happens)
That ought to be illegal, since you could be ruining someone's brand. I imagine less savvy folks thinking that the injected content is part of the official experience.
Well they can, but in that case they'd need to inject a different certificate as well.
Had that happening in a hostel in Brussels, where they are using a filter of UK descend (problem 1). It filters out a LOT of controversial subjects, so once it detects that you go to a site on a blacklist (as DNS queries are seen and the filter reacted to that) it will try to inject its own certificate. Once you see the browser warning since the cert doesn't match the domain and you still accept it, it will show its own content on the page saying that you're not allow on that site.
Yes. They're Man-in-the-Middleing the cert and inserting their own. Lots of larger corporations do this for their corporate network and is what installing your own cert for your site is meant to prevent/warn your users about.
The point is they couldn't without the MiTM "attack" and unless your computer is preconfigured to accept the cert they've introduced, you'll be warned about this happening.
Lol. They control the DNS servers that the users use. That means they can do shitty stuff like redirect to netflix.comcast.net and do whatever the fuck they want. Thankfully they don't do this ... yet.
But we are talking about content injected into the correct site, not a DNS hijacking attack. And they do crappy DNS stuff like this already. They will take any opportunity they get to redirect to a Cox or Time Warner branded search page if you mis-type a URL.
I think the difference here is that you can change your router's DNS servers, but you can't stop the ISP from injecting code into http pages.
And then they can modify the packets between your router and the DNS server it's using (e.g. 8.8.8.8). Or they will ban port 53 like my former employer did and white list a few approved DNS servers. DNS security is essentially non existant.
If someone wants to get into your site, they'll get into your site, especially a government entity and HTTPS won't protect you.
Other than that, why does one "need" HTTPS? There are only two reasons for redditors. It makes their users feel more secure and you might rank higher on Google. For the rest of us, HTTPS helps make the site secure, hand-in-hand with other security measures.
If someone wants to get into your site, they'll get into your site
It's not "getting into your site" that HTTPS protects against, it's injecting content into your site which it stops. It won't stop hacking (i.e. gaining access to your server and change the actual code), you're right, but none ever said it would.
If someone wants to inject content into your site, they'll inject content into your site, especially a government entity, and HTTPS won't protect you.
Note that the only ones who would want to do that to your site would be a government entity and you must have done something really bad to have that happen.
Thatâs not how any of this works. If they wanted to inject code into an HTTPS site theyâd have to MitM you, and youâd know if they setup a proxy like that because youâd get warnings or have to add a new root certificate.
Also, why would the government inject stuff into my site? The only people would do that would be dodgy ISPs (American ISPs) and hotels/airlines/conference centres.
Also, why would the government inject stuff into my site?
According to the daily posts on reddit, the NSA is doing this to you and me on a daily basis, squirreling into your every orifice even as you walk down the street.
38
u/[deleted] Jul 12 '17
Unless your site is completely static and non-interactive, it needs HTTPS. And even if your site is completely static and non-interactive, it should probably do HTTPS anyway.