HTTP Observatory: analyze your website and review available methods to secure it

Re:HTTP Observatory: analyze your website and review availab... by jvehent on Saturday August 27, 2016 @11:35AM (#12372764)

Direct link to the live Observatory: https://observatory.mozilla.org/

Example run on addons.mozilla.org: https://observatory.mozilla.org/analyze.html?host=addons.moz...

The Observatory measures site's compliance with the Web Security guidelines [1] and the Server Side TLS guidelines [2]. It's primarily meant as a helper for website developers and operators.

[1] https://wiki.mozilla.org/Security/Guidelines/Web_Security

[2] https://wiki.mozilla.org/Security/Server_Side_TLS

(disclaimer: I work on security at Mozilla)

[ Parent | on HN ]

Re:HTTP Observatory: analyze your website and review availab... by quickben on Saturday August 27, 2016 @02:38PM (#12373556)

Maybe it should be called it Https observatory?

I run http only site, I installed everything from scratch and minimized all attack surfaces. I got F because I'm lacking https stuff.

But maybe I'm missing something. If you don't deal with user logins and no sessions. Do I need to get https?

Or is this site just assuming things?

[ Parent | on HN ]

Re:HTTP Observatory: analyze your website and review availab... by jvehent on Saturday August 27, 2016 @02:57PM (#12373648)

You need https to guarantee data in transit is not being modified between your server and web clients. ISPs, for instance, have a bad tendency to inject tracking cookies in http traffic.

[ Parent | on HN ]

Re:HTTP Observatory: analyze your website and review availab... by quickben on Saturday August 27, 2016 @03:12PM (#12373700)

Ahhh. Okay. Thanks.

[ Parent | on HN ]

Re:HTTP Observatory: analyze your website and review availab... by majewsky on Saturday August 27, 2016 @05:33PM (#12374285)

It's 2016. There's just no excuse anymore not to do TLS.

[ Parent | on HN ]

Re:HTTP Observatory: analyze your website and review availab... by rmdoss on Saturday August 27, 2016 @02:57PM (#12373647)

Yep, agree 100% very short sighted view of security. Their grades doesn't mean anything, other than confuse people thinking they are secure.

[ Parent | on HN ]