HTTP Observatory: analyze your website and review available methods to secure it

Re:HTTP Observatory: analyze your website and review availab... by quickben on Saturday August 27, 2016 @02:38PM (#12373556)

Maybe it should be called it Https observatory?

I run http only site, I installed everything from scratch and minimized all attack surfaces. I got F because I'm lacking https stuff.

But maybe I'm missing something. If you don't deal with user logins and no sessions. Do I need to get https?

Or is this site just assuming things?

[ Parent | on HN ]

Re:HTTP Observatory: analyze your website and review availab... by jvehent on Saturday August 27, 2016 @02:57PM (#12373648)

You need https to guarantee data in transit is not being modified between your server and web clients. ISPs, for instance, have a bad tendency to inject tracking cookies in http traffic.

[ Parent | on HN ]

Re:HTTP Observatory: analyze your website and review availab... by quickben on Saturday August 27, 2016 @03:12PM (#12373700)

Ahhh. Okay. Thanks.

[ Parent | on HN ]

Re:HTTP Observatory: analyze your website and review availab... by majewsky on Saturday August 27, 2016 @05:33PM (#12374285)

It's 2016. There's just no excuse anymore not to do TLS.

[ Parent | on HN ]

Re:HTTP Observatory: analyze your website and review availab... by rmdoss on Saturday August 27, 2016 @02:57PM (#12373647)

Yep, agree 100% very short sighted view of security. Their grades doesn't mean anything, other than confuse people thinking they are secure.

[ Parent | on HN ]