When you have a secure site that uses Adsense, Google only serves ads from secure ad servers. This shrinks the pool of competing bidders significantly.

For me to switch back, either Google needs to push advertising networks into securing their ad servers, or the nonsecure warning will have to be really big and scary.

Considering that at least part of the ad clicks comes from robots (there was a recent post about that on HN), it might be that some of your lost revenue was due to that effect.

2,230,909 Page views 2,094,927 regular traffic 126,337 crawlers/bots 9,645 threats

While there certainly are a lot of automated visits, they are still a fraction of what appears to be legitimate traffic. Furthermore, I'm pretty sure that CloudFlare blocks or challenges (edit: malicious) bot traffic, so I doubt that is the spoon that is stirring the pot.

I am not alone in reporting this: https://www.seroundtable.com/https-google-adsense-19035.html

It is a serious issue, one which I'm sure is hindering https adoption around the web.

I'm proud to contribute to a saner Internet and it does matter even for small blogs because I noticed networks that inject content in websites - I don't know how this practice evolved in the US, but a couple of years ago while traveling there the Wifi networks in the 2 motels I stayed at were injecting ads in the websites I was visiting. I found that to be extremely distasteful.

For me HTTPS is a way of signing my content. Shameless plug - https://www.bionicspirit.com/ :-)

"HTTPS-enabled sites require that all content on the page, including the ads, be SSL-compliant. As such, AdSense will remove all non-SSL compliant ads from competing in the auction on these pages. If you do decide to convert your HTTP site to HTTPS, please be aware that because we remove non-SSL compliant ads from the auction, thereby reducing auction pressure, ads on your HTTPS pages might earn less than those on your HTTP pages."

But only in the sense that the article text could say e.g. "implement the authentication algorithm according to illustration #42" and illustration #42 could have been maliciously replaced with an image showing an incorrect implementation, right?

A script served over an insecure connection, on the other hand, would give the attacker access to the DOM and compromise the entire page (and other pages on the site with AJAX).

So does the fact that ads need to be served securely imply that they have the ability to execute JavaScript in the context of the page? By serving ads (whether encrypted or not) am I trusting every advertiser on the network with the session cookies of all my users, essentially allowing them to intercept communications between the site and its users?

I do not believe that I can improve on their systems.

Or, you know, loading untrusted javascript onto your page could also jeopardize the security of your site.

Cost. Today I host my website for 6 cents a month as a static page on Amazon S3.

To go https, I'd have to first acquire a certificate (lucky that can be free and with Let's Encrypt will be). Then I have to find someone to host that certificate. I can pay someone hundreds to thousands of dollars in setup and monthly fees.

Or, the cheapest option I've found is to get a $6/mo VPS as a frontend, put nginx on it, and put my cert there. The problem is that costs 100 times as much as what I pay now, and I have to maintain a server and it's not served from multiple redundant servers like my site is now.

Or I can use Amazon's free SNI support, making it so that older browsers can't see my site and I have no way of blocking people from using http or redirecting them.

There is currently no good, cheap option to do SSL only that is viewable by everyone.

That's why I haven't switched yet.

SNI works with anyone on Windows > XP, and any mobile / Apple / Linux OS you'll find visiting your site. How many IE6/XP hits does your site get per month?

The bigger problem right now is Android 2.x. But the lifetime of phones is only about 2 years and the market-share of Android 2.x has dropped below 20%.

And it really depends on the audience. The market share of all IExplorer versions on my blog is less than 4%, out of which IExplorer 11 represents more than half of that.

Below 10% even[1]. Agreed on device lifetime. Unlike PCs that can stick it out much longer, give it another year and it'll be well below IE6 levels. Can't come soon enough.

[1] https://developer.android.com/about/dashboards/index.html

If SSL was truley as trivial as a check box, then we would see very wide adoption.

The "100 times as much" is not that impressive, if it merely goes from 6 cents to 6 dollars.

6 cents vs 6 dollars is the difference between a person in a low-income economy spending 0.1% vs 18% of their income on a website.

[1]: http://data.worldbank.org/country/congo-dem-rep

We need better infrastructure.

Yes, although only recently and only slightly.

http://googlewebmastercentral.blogspot.com/2014/08/https-as-...

Currently, the NSA (and others, presumably) consider the presence of encryption as part of their is_suspicious() heuristic. Other people do have need for encryption, and by saying "I (currently) have nothing to hide", you are saying that you are fine with a high correlation between "uses encryption" and "is doing something suspicious". More than any other reason, we need to dilute that correlation until all data looks similar to remove the possibility of this kind of categorization.

2) https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html

As Zimmermann said, we need to socially normalize the use of envelopes instead of the postcards that are currently used. Without that social expectation, it will be possible to legislate against the use of encryption in the future.

3) It lets us (in the very long term) simply retire 80/tcp

...and plain HTTP servers in general. Sure, this is a minor benefit, but it would still be nice.

My thoughts

1. Not having secrets - MITM isn't necessarily conducted by malicious attackers, but that doesn't mean it's bad. Consider for example a company that wants to identify usage behavior and buys traffic data from an ISP. While the data may be anonymized it's still someone's usage. With https, a webmaster is limiting the info those companies can get so instead of being able to run a complete analysis on the type of text a user reads and images they see, over https they could only tell what websites you go to. It's still pretty bad, but not as bad.

2. Cost - I do see the value of cheap hosting on S3 and getting redundancy. I've been hosting servers from the days before AWS existed (I started young) and know one thing - if you can't afford something you probably don't need it.

Why does you $0.06 site need to have a multi node setup? I don't mean to sound like a jerk but if you had the kind of traffic a multi node + DSL site needs you'd probably have the funds to invest in it. It's really not very expensive considering a cup of Starbucks coffee costs 100 times what you currently pay for hosting...

If your content isn't secret why not go with a cheap SNI that can host your certificate and put that behind cloudflare (which is free)?

I'll ignore he obvious selfish nature of this question and simply point out that you may need to take advantage of that "culture of always encrypting everything at some point in the future. It is incredibly short-sighted to assume that you're not ever going to be a target.

> "not having secrets"

You can look the numerous rebuttals for this very well-known fallacy.

> Cost.

It's probably worth mentioning that I am currently living on SSDI (social security disability income) thanks to some unfortunate medical issues. I cannot actually afford any PKI cert and related costs, even $20 costs.

Well, the EFF may soon have a free solution for this, and almost all of the benefits I list are still valid even when the crypto is relying on an self-signed certificate automagically generated by apache on first use.

I would love to see more options that address the cost issue - secure communications should not be limited to those that can afford various economic barriers, but for now at least some solution exists.

So no, they are not an option for everybody.

Really? Do you think we're all sheeple that are happy to have every facet of our lives tracked? You don't think that someone has a database of every taboo thing you considered buying or seen online, every contrarian political article you've read, etc? You don't think that they're sitting on this cache until they find a way to sell it to anyone that will buy it or score you some way in a Big Data metric? I know people in that industry. They tell me the public isn't ready the handle how much information is for sale about them.

Viewpoints like these feed the sheeple with naivety that they themselves are good people, so the corporations, government agencies and hackers that spy and exploit the gaping chinks in the armor of the Web would certainly have no reason to exploit such good citizens.

By not encrypting traffic, web masters who think they don't have secrets are really just selling their users. That's bad.

If those agencies had a problem with https, they wouldn't let a Google team popularize it.

Https is, in all likelyhood, as transparent to them as a piece of glass.

It still has an effect of making your traffic not stand out from anybody else's in a DPI. Also, the TLAs are not the only attacker, and HTTPS may not be transparent to them.

The key feature is that it requires a MitM. That is not easy or cheap, compared to simply catch everything with a simple passive beam-splitter. The idea it is easy to get bulk data with XKEYSCORE/PRISM, but requiring the use of QUANTUM, FOXACID, and other fancier tools is not something that cannot be [cheap, undetected, used against everybody] simultaneously.

2) Pinning?

3) No, let's not do that. I want to be able to access my sites from my 2-year old devices that don't support SNI, like Android 2.3.

Switched to https shortly after.

Man, it's really all about advertising these days...

In the same way as TURKTRUST was thrown out by all vendors a few years ago, nowadays you should throw out VeriSign and GoDaddy just as well.

Have vendors done it? Because users will surely not bother.

Besides, what makes the other CAs' trustworthy?

They are just some companies, with offices, CEOs, etc. Can have ties to the government, deals, pressure on them, or even just plain planted engineers...

SSL everywhere isn't yet practical only due to the expense. It's not that much more effort to secure a site but when you run 10 sites then you're spending $100 a year for those domains. The expense of an SSL certificate each on top of that makes it impractical for solo "webmasters" to secure all their sites. We all know why we should use HTTPS and we do it when it makes sense but it's just not practical 100% of the time yet. Like others have said, this will make more sense once the EFF initiative starts being adopted and getting a free certificate is as easy as apt-get secure-me-please.

Most people wouldn't be comfortable with a stranger looking over your shoulder while they logged in. This is the same thing, only you don't think about it.

These things are ALL rare, but why would you want to expose yourself to this?

SSL everywhere is also about improving security for those who don't realize that they might be engaging in behaviors that compromise their own security.

That is a completely different problem that using https won't solve. It's like building a ship with a hole at the bottom and having a high throughput water pump.

Also note that as tech-savvy people, we have more responsibility in ensuring our users are safe, even from themselves. Sure, the better thing to do would be to educate everyone so they don't reuse passwords. But it will take time, and using HTTPS in the meantime decreases the chance for them to be pwned.

So in order to show an alert whenever sites that should be encrypted aren't, you just have to show an alert all the time. The SSL everywhere movement and Let's Encrypt are about making encryption easy enough for sites like yours that it's practical to do that.

Basically, your site being encrypted, even if it doesn't specifically need to be, helps to improve security of the web as a whole.

You shouldn't put in the work to switch over either. But in 2 years it will be easier for you to have a https blog than a http blog and you will naturally switch.

This is why all my blogs/sites are on SSL (or being converted in 1 case). Do you think people really check those md5sum's on the downloads from your OSS project page/blog? Make that unnecessary and use SSL. BTW, my CloudFront charges only went up 5% (i.e. a few bucks) and all my certs cost $2/ea because I stocked up at a sale. It's not a matter of money for most admins.

The question is not "Why SSL" by "Why not?"

Of course sites should be using HSTS to help prevent this, but if the user is visiting the linked site for the first time, HSTS can't protect them.

https://www.bitballoon.com/blog/2014/10/03/five-reasons-you-...

They do: http://googlewebmastercentral.blogspot.de/2014/08/https-as-r...

https://www.websmithing.com/gpstracker/displaymap.php

Can't Google spend a little more time securing their own websites instead of telling everyone else to secure theirs?

http://googlewebmastercentral.blogspot.com/2014/08/https-as-...