News for hackers. Stuff that matters.
Re:A basic guide to when and how to deploy HTTPS by jiggy2011 on Saturday December 21, 2013 @01:58PM (#6947536)
What if some of your users will be behind a network level web-filter (like the one soon to be deployed in the UK)? If you run HTTPs your entire site will be blocked because 1 page fails the filter (because of a single swear word for example).
Re:A basic guide to when and how to deploy HTTPS by JoshTriplett on Saturday December 21, 2013 @02:32PM (#6947654)
Then HTTPS is doing its job by preventing an active MITM attack by a hostile third party.

Option 1: negotiate with the filter maintainers to get your site whitelisted; that may require changing your content, but a site in which you have a commercial interest probably shouldn't have content on it that trips most filters (with some obvious exceptions on which the filter would be doing its job).

Option 2: inform your users that they need to opt out of the filter in question, assuming they're in a situation/regime that allows doing so. Make it clear to them exactly which content is tripping the filter, and hope their reaction is "that's absurd".

Option 3: maintain an insecure HTTP site for use from such locations, and arrange to redirect there or inform your users that they'll need to use that version due to the filter they're using.

Re:A basic guide to when and how to deploy HTTPS by Silhouette on Saturday December 21, 2013 @09:21PM (#6949052)
Nonsense. Blocking HTTPS traffic rules out far too many useful/essential things: e-commerce for home users, VPNs for business users away from the office, online banking and other financial services, any sort of government service that requires authentication. The list goes on and on, and the people most likely to defend secure browsing are going to be the likes of governments and financial institutions.
Re:A basic guide to when and how to deploy HTTPS by pushrax on Saturday December 21, 2013 @02:16PM (#6947595)
HTTPS means PG-13 in the UK's network filter?
Re:A basic guide to when and how to deploy HTTPS by jiggy2011 on Saturday December 21, 2013 @02:31PM (#6947651)
With https the filter cannot mitm and figure out which page is being accessed, so will have to block the entire site.
Re:A basic guide to when and how to deploy HTTPS by BgSpnnrs on Saturday December 21, 2013 @02:40PM (#6947695)
What filter are you discussing? AFAIK UK filtering is done by ISPs and conforms to their own solutions, there is no plan for a statewide filtering system.
Re:A basic guide to when and how to deploy HTTPS by jiggy2011 on Saturday December 21, 2013 @02:47PM (#6947718)
The filtering will be enabled by default for all large ISPs, so potentially a large % of the UK. You have the same problem with HTTPS either way.
Re:A basic guide to when and how to deploy HTTPS by revelation on Saturday December 21, 2013 @03:55PM (#6948022)
I do not think thats how these filters operate. No banking/shopping site would properly function. They are just stupid IP based filters.