News for hackers. Stuff that matters.
Re:Announcing Free and Automated SSL Certs by user5994461 on Tuesday March 21, 2017 @04:28PM (#13925926)
That makes sense for a hosting service. A lot of them works that way. Hosting a static free blog doesn't need TLS.
Re:Announcing Free and Automated SSL Certs by icebraining on Tuesday March 21, 2017 @04:52PM (#13926099)
Considering the amount of crap ISPs have been known to inject into websites, I disagree. TLS isn't just for encryption, it also provides data integrity.
Re:Announcing Free and Automated SSL Certs by Godel_unicode on Tuesday March 21, 2017 @06:27PM (#13926865)
This is the correct answer. Use this reasoning.
Re:Announcing Free and Automated SSL Certs by IgorPartola on Tuesday March 21, 2017 @05:14PM (#13926287)
Yes it does. Stop spreading this misinformation because it is dangerous. Everything should be encrypted. I don't want people knowing that I'm reading your blog or what on it I am reading.
Re:Announcing Free and Automated SSL Certs by Jach on Tuesday March 21, 2017 @07:03PM (#13927084)
Now who's spreading misinformation? HTTPS doesn't protect the fact you're reading a blog (the IP of the server will be observed, and typically the server name through the cert itself) and while one can't prove which URLs of the server you visited one can infer based on the amount of traffic sent.
Re:Announcing Free and Automated SSL Certs by samb1729 on Tuesday March 21, 2017 @07:58PM (#13927423)
There's a pretty significant difference between someone being able to tell, for example, that you visited medium.com, and that same someone being able to tell exactly which blog post you read because the whole request is unencrypted.
Re:Announcing Free and Automated SSL Certs by LukeShu on Tuesday March 21, 2017 @09:02PM (#13927738)
Beyond just the cert itself, the client will typically announce in plaintext the hostname it is seeking to talk to, as part of SNI.
Re:Announcing Free and Automated SSL Certs by JoshTriplett on Tuesday March 21, 2017 @04:46PM (#13926062)
> Hosting a static free blog doesn't need TLS.

Many kinds of static content need TLS, including protection from MITM and protection from eavesdroppers. Static doesn't mean "not sensitive". (Leaving aside the reasonable presumption today that all content is potentially sensitive.)