Securing access to Wikimedia sites with HTTPS by default

Re:Securing access to Wikimedia sites with HTTPS by default by tacone on Friday June 12, 2015 @11:24AM (#9706436)

Exactly. The problem is that News sites rely on advertising.

Due to the general low technical quality of adv companies/companies' suppliers/customers etc you will find often find an image/flash/js served over plain HTTP or with a bad certificate.

That single HTTP bit will immediately trigger the terroristic browser behaviours we learned to accept and love, including but not limited to: red signs, technical jargon pop ups, fully red pages with jargon disclaimers of all sorts and "getme outta here" buttons.

Funnily enough, I remember reading a technical blog post written by Guardian devs themselves, citing this very problem.

[ Parent | on HN ]

Re:Securing access to Wikimedia sites with HTTPS by default by pixl97 on Friday June 12, 2015 @11:56AM (#9706663)

The browser isn't exactly wrong for triggering those 'terroristic' behaviors. If there is one single http bit being included and rendered on the https web page then the entire security of the page is rendered useless if there is a MITM attacker between you and the source. That single http bit can include whatever the attacker needs in javascript to redesign the page to steal content and provide tampered content.

[ Parent | on HN ]