Ask HN: Put my entire website behind ssl?

Re:Ask HN: Put my entire website behind ssl? by mattgaidica on Thursday April 07, 2011 @04:33PM (#2421091)

No. I think the HTTPS in the browser prompts a user to think there is confidential information being passed when your just browsing, so now your break user experience. The app portion could be, and should be for any semi-secret information, but keep the front-end clear of it. Plus any and all external resources in-page must be https, it might hang you or a designer up down the road and break your cert.

[ Parent | on HN ]

Re:Ask HN: Put my entire website behind ssl? by rubyskills on Thursday April 07, 2011 @04:42PM (#2421121)

Very good points!

It's very interesting to me that when SSL opens up, you immediately feel like confidential information information is going to be passed (which is usually the case).. I didn't think about that before!

The app portion is def. protected by SSL and switches to that context when you hit the login path.

Your last point is interesting too, as we do pull in external resources such as google fonts, jquery (google's CDN), analytics, etc. but have managed to find an SSL version of those URL's too (luckily). I do see this becoming painful for designers moving forward though when they're trying to pull in external resources that lack support for https url's.

All very good points.

Do you think the average user notices the SSL activation bar?

[ Parent | on HN ]

Re:Ask HN: Put my entire website behind ssl? by mattgaidica on Thursday April 07, 2011 @05:06PM (#2421204)

Yea, luckily nearly every major API and service (Amazon, Facebook, Google..) has an encrypted version to pull from. So as long as the entire team understands that, then I only have the usability issue as an argument. If we could get GoDaddy and other hosts to have like a $10 "Add SSL" feature, I think we would see a really good adoption of it being the standard!

[ Parent | on HN ]

Re:Ask HN: Put my entire website behind ssl? by HerraBRE on Thursday April 07, 2011 @04:40PM (#2421114)

I disagree. I might not spring for an EV cert in most cases, but using basic encryption to protect against casual eavesdropping should be the rule, not the exception.

[ Parent | on HN ]

Re:Ask HN: Put my entire website behind ssl? by mattgaidica on Thursday April 07, 2011 @04:50PM (#2421147)

I am 100% with that mentality, I guess I just see the overhead and understanding of HTTPS causing more problems in practice than solutions for developers who are not security-centric. Think we'll ever see google.com go to SSL?

[ Parent | on HN ]

Re:Ask HN: Put my entire website behind ssl? by rubyskills on Thursday April 07, 2011 @04:55PM (#2421163)

I'm on this boat too. It irritates me that facebook is pretty wishy washy about which urls they decide to encrypt and which they don't...

[ Parent | on HN ]