Google Chrome is supposed to soon start flashing a "not secure" warning on HTTP sites that have password forms [0]. That's probably at least one motivation for these publisher moves to HTTPS

[0] https://security.googleblog.com/2016/09/moving-towards-more-...

Firefox 51 is slated to have this as well.

https://bugzilla.mozilla.org/show_bug.cgi?id=1319119

What happens with local LAN machines, like the admin webpage for your wireless access point? It's not like they can go HTTPS?

if those pages are not secure, then they will display "not secure" in the address bar.

They're not trying to force everything over to https, they're just trying to make warnings more sane. And if a page is not secure, marking it as such makes sense.

https://security.googleblog.com/2016/09/moving-towards-more-...

This is an issue we're encountering. One solution is trust on first use of a self signed cert, which makes the scary untrusted page a one time cost. This isn't terribly easy in the browser though. With more IOT devices entering the market, this could become a more common issue.

Using https for a local network connection will also be more common, in the case you decide you don't trust the network.

I think for the case of the home router admin page (or really any admin page on your local network), the browser can easily detect that it's being served a page on the local net, and could provide a less scary warning that has some text that acknowledges that you're on your local net and that either ignoring the password form security warning (for http) or accepting the self-signed cert (for https) is probably ok. Whether they'll do this is another question...

It absolutely makes sense not to display warnings that HTTPS isn't in use in circumstances where HTTPS is not feasible - i.e. local addresses. It's simple enough for a browser to determine. I don't think conditionally accepting a self-signed cert is necessary.

There's gonna be a small "not secure" label next to the URL (like there's now the "secure" label on HTTPS websites in Chrome/Chromium). It's not like you're not going to be able to open the webpage or anything.

I could have sworn firefox already did this, or maybe that ws just elinks...

In current stable Firefox, you have to manually enable `security.insecure_password.ui.enabled` for that.

The change is to set it on by default.

A few more here:

https://securethe.news/sites/

Oh, the irony:

  Loading mixed (insecure) display content “http://analytics.freedom.press/piwik.php?idsite=4” on a secure page

Still waiting for Ars Technica to roll that out (for non subscribers)...

Does Ars Technica support HTTPS for subscribers? That's an interesting option for sharing the support cost of HTTPS hosting.

Is that still a thing? My understanding was that https these days adds very little to the cost of hosting a site, given hardware accelerated crypto being more prevalent, and other niceties.

The Intercept uses HTTPS.

So does Quartz. Those sites are, technologically speaking, glorified blogs--not comparable to a major paper like the Times or Post.

'Glorified blog'? The only big difference I can tell is that those 'glorified blogs' are not being printed on real paper. I'm not sure how that makes those newspaper who also have a 'glorified blog' anything more or less than that (plus a physical paper). None of this tells us anything about the quality of the 'glorified blog'.

That's why I said technologically speaking.

The Intercept and Quartz each only publish a few articles per day. Each runs entirely on a single instance of Wordpress. Each covers only a few topics. Each has only a few templates, and simple ad inventory, if any.

A paper like the New York Times publishes many hundreds of stories every day, on almost every topic you can think of. They publish to wide variety of platforms, including print. They have a high volume of widely varying ad inventory. They have legacy content going back decades, in all sorts of legacy formats, perhaps even sitting in old CMS instances on separate servers.

TECHNOLOGICALLY SPEAKING, they are much more complex. Therefore transitioning to HTTPS is more difficult.

None of this is a commentary on the quality or social/cultural value of their content.

Would be ironic for them not to.