Skip to content
Hallway
0:00 / 0:00

#https#ssl#mitm

Here's Why Your Static Website Needs HTTPS

Troy Hunt

25K subscribers • 1 video on Hallway

YouTube
  • Recommended by 2 people: 2 on Hacker News.
  • A classic. People kept recommending it from 2020 to 2023.
  • Presented by Troy Hunt, creator of Have I Been Pwned
  • May be out of date. Uploaded 8 years ago, in an area where tools change fast.
  • An opinion. It argues one side of a question engineers disagree on.

Beginner. No background in the topic needed.

30K views8 years ago2 recommendations

SecurityWeb developmentWeb and application securityNetworking and protocols

Troy Hunt demonstrates why even static websites require HTTPS by showing how attackers can inject malicious content or exploit unencrypted traffic.

This is part of the blog post at troyhunt.com/heres-why-your-static-website-needs-https

Why it's here

2 people recommend this

What people say. Recommended as a clear and convincing demonstration of why even static, non-secret websites must use HTTPS.

sbmthakuron Hacker News • Recommends

On “Tell HN: 6.3% of HN top submissions in plain HTTP, more than half upgradable”

This was the article that convinced me to be HTTPS everywhere (well maybe in 99.99% cases if not everywhere). The linked video is a must watch to those who still doubt HTTPS0. The mention of China's Great Cannon was particularly eye-opening1. 0. link to this video 1. link
View on Hacker News

DigitalNoumenaon Hacker News • Recommends

On “Learn the basics of digital electronics with the hands-on Logic Lab kit”

link The whole video is great, but particularly this: link to this video link There are a lot of arguments about why, even non-secret data connection need encryption. The first and most obvious is that not doing so immediately puts a target on the encrypted data. By no means an expert but to me it seems like an oversight not to.
View on Hacker News

_Nat_on Hacker News • Mentions

On “How to Work Hard”

The reason I'd advocate in more public settings is that things ought to be secure-by-default, and that adopting security only upon realizing its necessity is a hazard-prone policy that constantly backfires. But for a specific example of something that could go wrong: someone could inject malicious content into a non-secure page. The original content might be plain-text, but a man-in-the-middle can still inject whatever they like regardless. As a common example of a simple attack: an attacker could man-in-the-middle people who connect to a nearby wireless network. Notes: 1. There're a bunch of ways that an attacker could get people to connect to their network. Examples: spoofing a legitimate…
View on Hacker News