Ask HN: Why are so few links posted as https?

https://news.ycombinator.com/item?id=8020575

by ejr • 12 years ago

15 19 12 years ago

news.ycombinator.com

I've been lurking for quite a while now and noticed that even though many of the sites linked support SSL connections, not many are posted as https.

In the comments too most people still post http. Ex: The Wikipedia links everyone seems to love.

Is this just because of old habits or do people use plugins that force https in the background?

MattBearman• 12 years ago

I suspect the problem is that http is still the default. If you type a url without a protocol into a browser, it goes to http://[url]

So unless the site in question is set up to redirect http requests to https, most links will be http.

I wonder if browsers should always try https first if no protocol is specified? But then as has been pointed out before on here, there's no guarantee that the http and https versions of the same url will have the same content.

ejr3• 12 years ago

Good point. I borrowed a computer that had "HTTP Nowhere" installed on Firefox, but that seemed to break a lot of things to the point I had to turn it off. That may explain why browsers still default to http.

quesera3• 12 years ago

HTTPS Everywhere works great, all the time, for me. I've never heard of "HTTP Nowhere". If you were just misremembering the name, it might have been a long ago old version? Or maybe the borrowed computer was otherwise jacked.

theandrewbailey3• 12 years ago

Defaulting to HTTPS would be great, except for the fact that different apps can run on different ports. Port 80 != port 443.

justbaker• 12 years ago

I don't see why this is relevant. You can proxy it to another port?

nandhp2• 12 years ago

They could also help drive HTTPS adoption by being more alarmist about unencrypted traffic (e.g. a warning triangle instead of a globe icon).

Someone1234• 12 years ago

I suspect the search engines (Google, Bing, DDG) could do a huge amount to combat this if they so wished.

Just check if the HTTP and HTTPS site returns near identical results (e.g. same title, response code, etc) then link to the HTTPS version by default.

A lot of links that get posted are directly taken (ultimately) from search engine results. Someone will search, view the page, then copy/paste it to others.

ejr3• 12 years ago

Resource efficiency has a lot to do with that, I think. Crawling sites twice will add not only to the burden of the bots but the sites too. Admins may disapprove of this.

I wonder if users can be motivated to do the checking themselves when they post the link.

quesera3• 12 years ago

Could try https first, then.

While it's possible to serve completely different pages and sites on https vs http, it's rare in practice, and would be reasonable to penalize.

nandhp2• 12 years ago

Google has talked about doing this, but doesn't seem to have rolled it out yet.

wildpeaks• 12 years ago

This article from 4 days ago hints Google has finally started doing it: https://blog.httpwatch.com/2014/07/07/google-has-given-https...

Did other sites observe the same https boost recently ?

theandrewbailey3• 12 years ago

I use HTTPS Everywhere, so even if links are posted as HTTP, I will be directed to HTTPS for sites that support it. It rewrites the URL browser side, so there's never an HTTP 426.

https://www.eff.org/https-everywhere

DanBC• 12 years ago

I don't care. SSL is probably good enough for a few pages that I want protected and I don't care about the rest. I haven't thought about it. If people express a strong preference either way I'll try to remember.

pestaa• 12 years ago

It is not only to protect the few pages on which you enter sensitive data. All traffic should be protected from man in the middle attacks.

Also if all traffic was protected, attackers wouldn't know which one is worth hacking; now it's still quite obvious.

Ask HN: Why are so few links posted as https?

Related Stories