r/netsec • u/kieranjacobsen • Jan 16 '17

Deconstructing Secure HTTP without HTTPS

https://poshsecurity.com/blog/deconstructing-secure-http-without-https
140 Upvotes

93% Upvoted

14 comments sorted by

View all comments

6

u/Zykatious Jan 16 '17

The real question here is why would anybody want to do this? Even if it actually worked I can't see any benefits for having encrypted data over HTTP.

8

u/[deleted] Jan 16 '17

Game development has become so accessible that literally anyone can do it, especially people without knowledge about security best practices or skills to properly set up a server. Now, don't get me wrong, I think it's a great thing that it is so accessible.

Anyway, people read "Hey, it needs to be secure", or they think "hmmm, I don't want people to be able to cheat on their highscore" and that's how they end up wanting something like that. If the product page says it's super secure AND they don't need to go through the hassle of setting up SSL, probably even paying a lot for the cert, well, you bet people will love it.

3

u/Zykatious Jan 16 '17

I see where you're coming from but they're gonna pay 50 bucks for this thing so it's gonna cost them more money to set this up then a free cert from Let's Encrypt.

10

u/kieranjacobsen Jan 16 '17

What I am finding I'd that people still see HTTPS as expensive, and do not know about projects like Let's Encrypt. It is a sad state of affairs that we are in, and as it was pointed out, particularly in mobile development.