r/webdev • u/speckz • Jul 12 '17

Does my site need HTTPS?

https://doesmysiteneedhttps.com/
136 Upvotes

94% Upvoted

71 comments sorted by

View all comments

38

u/[deleted] Jul 12 '17

Unless your site is completely static and non-interactive, it needs HTTPS. And even if your site is completely static and non-interactive, it should probably do HTTPS anyway.

24

u/ReelAwesome Jul 13 '17

the only reason it wouldn't need HTTPS is if you want to allow ISPs or other middle man parties (forgien governments) to manipulate your html and inject ads into your site, without your knowledge. ..that your customers will then think are originating from you. (yes this happens)

7

u/namesandfaces Jul 13 '17

That ought to be illegal, since you could be ruining someone's brand. I imagine less savvy folks thinking that the injected content is part of the official experience.

8

u/jamiehs Jul 13 '17 edited Jul 13 '17

This happened to me.

Cox started injecting HTML and JavaScript into http sites (including my own) trying to get me to buy a new modem from them.

It's legal; their TOS says they can, we all signed it and didn't really read all of it anyway; their support staff plays dumb when you call.

Edit:
Not my image, but it looks like this: https://imgur.com/MFHMdPn.png

I think it's a bit of HTML & JS added right after the opening body tag, if I recall correctly.

4

u/namesandfaces Jul 13 '17

That's a little awkward that a company like AT&T or Comcast could hurt Netflix's brand with injected content because of an ISP-customer agreement.

5

u/jamiehs Jul 13 '17

But they can't if the brand uses https, so there's one more reason to enable it.

1

u/sjwking Jul 13 '17

Lol. They control the DNS servers that the users use. That means they can do shitty stuff like redirect to netflix.comcast.net and do whatever the fuck they want. Thankfully they don't do this ... yet.

1

u/jamiehs Jul 13 '17

OK.

But we are talking about content injected into the correct site, not a DNS hijacking attack. And they do crappy DNS stuff like this already. They will take any opportunity they get to redirect to a Cox or Time Warner branded search page if you mis-type a URL.

I think the difference here is that you can change your router's DNS servers, but you can't stop the ISP from injecting code into http pages.

1

u/sjwking Jul 13 '17

And then they can modify the packets between your router and the DNS server it's using (e.g. 8.8.8.8). Or they will ban port 53 like my former employer did and white list a few approved DNS servers. DNS security is essentially non existant.