Here's Why Your Static Website Needs HTTPS
Why Hacker News recommends it
Cited as a must-watch persuasive case for HTTPS everywhere.
What it is
Troy Hunt argues that even static, non-secret websites need HTTPS, demonstrating attacks such as injected content and China's Great Cannon. It accompanies his blog post of the same name.
Recommended by 2 HN commenters across 2 different months, 2020 to 2023.
What Hacker News said
Strong rec sbmthakur · 2020-07 · on “Tell HN: 6.3% of HN top submissions in plain HTTP, more than half upgradable”
This was the article that convinced me to be HTTPS everywhere (well maybe in 99.99% cases if not everywhere). The linked video is a must watch to those who still doubt HTTPS[0]. The mention of China's Great Cannon was particularly eye-opening[1]. 0. [this video] 1. [LINK]
Recommends DigitalNoumena · 2023-08 · on “Learn the basics of digital electronics with the hands-on Logic Lab kit”
[LINK] The whole video is great, but particularly this: [this video] [LINK] There are a lot of arguments about why, even non-secret data connection need encryption. The first and most obvious is that not doing so immediately puts a target on the encrypted data. By no means an expert but to me it seems like an oversight not to.
Cites _Nat_ · 2021-06 · on “How to Work Hard”
The reason I'd advocate in more public settings is that things ought to be secure-by-default, and that adopting security only upon realizing its necessity is a hazard-prone policy that constantly backfires. But for a specific example of something that could go wrong: someone could inject malicious content into a non-secure page. The original content might be plain-text, but a man-in-the-middle can still inject whatever they like regardless. As a common example of a simple attack: an attacker could man-in-the-middle people who connect to a nearby wireless network. Notes: 1. There're a bunch of ways that an attacker could get people to connect to their network. Examples: spoofing a legitimate