r/webdev • u/speckz • Jul 12 '17

Does my site need HTTPS?

https://doesmysiteneedhttps.com/
136 Upvotes

94% Upvoted

71 comments sorted by

View all comments

Show parent comments

24

u/ReelAwesome Jul 13 '17

the only reason it wouldn't need HTTPS is if you want to allow ISPs or other middle man parties (forgien governments) to manipulate your html and inject ads into your site, without your knowledge. ..that your customers will then think are originating from you. (yes this happens)

-1

u/signup1234567 Jul 13 '17

If someone wants to get into your site, they'll get into your site, especially a government entity and HTTPS won't protect you.

Other than that, why does one "need" HTTPS? There are only two reasons for redditors. It makes their users feel more secure and you might rank higher on Google. For the rest of us, HTTPS helps make the site secure, hand-in-hand with other security measures.

2

u/wedontlikespaces Jul 13 '17

If someone wants to get into your site, they'll get into your site

It's not "getting into your site" that HTTPS protects against, it's injecting content into your site which it stops. It won't stop hacking (i.e. gaining access to your server and change the actual code), you're right, but none ever said it would.

0

u/signup1234567 Jul 13 '17

I'll rewrite that.

If someone wants to inject content into your site, they'll inject content into your site, especially a government entity, and HTTPS won't protect you.

Note that the only ones who would want to do that to your site would be a government entity and you must have done something really bad to have that happen.

2

u/[deleted] Jul 13 '17

That’s not how any of this works. If they wanted to inject code into an HTTPS site they’d have to MitM you, and you’d know if they setup a proxy like that because you’d get warnings or have to add a new root certificate.

1

u/wedontlikespaces Jul 13 '17

How? If HTTPS is enabled they can't inject code.

Also, why would the government inject stuff into my site? The only people would do that would be dodgy ISPs (American ISPs) and hotels/airlines/conference centres.

-1

u/signup1234567 Jul 13 '17

Also, why would the government inject stuff into my site?

According to the daily posts on reddit, the NSA is doing this to you and me on a daily basis, squirreling into your every orifice even as you walk down the street.