6 ms·
As long as neverssl.com still exists so I have some way to pop up the login page from captive wifi portals, I'm fine with everyone else going SSL. However, I b
by SnacksOnAPlane 9y ago
As long as neverssl.com still exists so I have some way to pop up the login page from captive wifi portals, I'm fine with everyone else going SSL.
However, I basically agree that if you're just hosting a blog with no user interaction, there's really no need for it. The threats (for example, somebody hijacks the request and returns different content) are minimal.
- dsfyu404ed 9y ago> The threats (for example, somebody hijacks the request and returns different content) are minimal. I wouldn't call injecting malware/adware/advertising minimal.
- lol768 9y ago> so I have some way to pop up the login page from captive wifi portals, I'm fine with everyone else going SSL Isn't this the fault of those deploying the captive portal for not implementing RFC7710 and advertising a secure login URL?
- Spivak 9y agoYes, but we have to work around crappy software all the time. I've used portals that only trigger on google.com
- qb45 9y agoFirst time I hear of RFC7710, all I see is HTTP hijacking. Does anybody support it, in particular OS vendors? I suppose some new UI or a new API for browsers would be required.
- organsnyder 9y agoI use example.com for this purpose. I'm guessing that they'll keep listening on port 80 for quite some time.
- schindlabua 9y agoI prefer example.org because I'm anti-capitalist and hate commerce.
- provost 9y agoThere are ISPs that have tools to inject arbitrary code into HTTP webpages. For example, My ISP injects notification banners into my web browser sometimes. Even if the ISP means well at the beginning, the tool can be abused (ISPs injecting tracking, or reading the tracking information so they can sell it). Attackers at coffee shops and conferences can do much worse.
- bo1024 9y agoThis is the reason I finally added SSL to my academic webpage.
- tomjen3 9y agoI thought so too, but there was one US ISP that started injecting headers.
- willstrafach 9y agoMinimal depending on location. In the USA, worst we have heard about is tracking cookies and injected notifications. In China, for example, malware injection has occurred from ISP's ad networks.
- TheAceOfHearts 9y agoYou can use example.com as well.
- mijoharas 9y agoI had such a problem trying to figure out a site I knew that didn't use ssl yesterday for this! Thanks for the tip.
- deleted 9y ago[deleted]
- jchw 9y agoYour users might care when malware is injected into your page.