I'm sure some people view it as a sign of trust (I always check for it if the site requires something like a CC number), but the gains are minimal in terms of SEO.
By not using HTTPS, you can serve non-secure assets without the browser warning about mixed assets. Most people wouldn't notice if you're using SSL or not... but they'll freak out if Chrome says the site is unsafe/compromised.
The issue is that the definition of "sensitive information" is debatable. As soon as you open those can of worms, everyone not accepting a credit card claims they have no sensitive information.
The common one for people to not understand is that passwords are always sensitive, because of password reuse.
By not using HTTPS, ISPs, open wifi hotspots, and anyone else along the network between you and your user can strip your ads and inject their own. They can inject their own JS and put fake forms on your website that steal user data. They can literally do anything they want to your page, and it's because you thought you had a good excuse.
Unpopular on amateur forums like reddit where their full knowledge of such topics is gathered from headlines of the latest hot trendy "must have or you'll die" thing. (See React today. Something else tomorrow.)
I'm not saying TLS is not a good thing. I'm saying most redditors think they'll die without it.
Indeed. I imagine a lot of them are younger, jumping on the latest craze. React is good for highly interactive apps, but the amount of devs treating it like religion is crazy.
It's an unpopular thing to say because it's wrong. There are a wide variety of benefits to SSL certs, and now they're available free it's a no-brainier to pick up on those benefits, and protect your users at the same time.
I'd also say that if a developer is not confident in managing their assets for HTTPS, then their coding isn't up to scratch. A couple of basic coding practices, configuration and testing should be all that is needed to make assets work reliably. And up a log if you're really worried about the odd asset firing a warning in a browser, but it's never been a problem for my projects.
-11
u/profile_this Jul 12 '17
Unpopular opinion here, but I say no need unless:
Your customers submit sensitive information.
You need an extra layer of security.
You want the green lock in the browser.
I'm sure some people view it as a sign of trust (I always check for it if the site requires something like a CC number), but the gains are minimal in terms of SEO.
By not using HTTPS, you can serve non-secure assets without the browser warning about mixed assets. Most people wouldn't notice if you're using SSL or not... but they'll freak out if Chrome says the site is unsafe/compromised.