Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Maybe it should be called it Https observatory?

I run http only site, I installed everything from scratch and minimized all attack surfaces. I got F because I'm lacking https stuff.

But maybe I'm missing something. If you don't deal with user logins and no sessions. Do I need to get https?

Or is this site just assuming things?



You need https to guarantee data in transit is not being modified between your server and web clients. ISPs, for instance, have a bad tendency to inject tracking cookies in http traffic.


Ahhh. Okay. Thanks.


It's 2016. There's just no excuse anymore not to do TLS.


Yep, agree 100% very short sighted view of security. Their grades doesn't mean anything, other than confuse people thinking they are secure.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: