Here's Why Your Static Website Needs HTTPS

This was the article that convinced me to be HTTPS everywhere (well maybe in 99.99% cases if not everywhere). The linked video is a must watch to those who still doubt HTTPS[0]. The mention of China's Great Cannon was particularly eye-opening[1]. 0. ▶ this video 1. link

link The whole video is great, but particularly this: ▶ this video link There are a lot of arguments about why, even non-secret data connection need encryption. The first and most obvious is that not doing so immediately puts a target on the encrypted data. By no means an expert but to me it seems like an oversight not to.

The reason I'd advocate in more public settings is that things ought to be secure-by-default, and that adopting security only upon realizing its necessity is a hazard-prone policy that constantly backfires. But for a specific example of something that could go wrong: someone could inject malicious content into a non-secure page. The original content might be plain-text, but a man-in-the-middle can still inject whatever they like regardless. As a common example of a simple attack: an attacker could man-in-the-middle people who connect to a nearby wireless network. Notes: 1. There're a bunch of ways that an attacker could get people to connect to their network. Examples: spoofing a legitimate network; setting up a password-less network; putting up a poster falsely advertising the SSID/pass to a network that falsely purports itself to be official; they're an actual employee of the establishment and just compromise the legitimate network; they're a remote-hacker who's exploited a vulnerability in the router. 2. The attacker could do lots of random stuff. Examples: they could inject malicious code; they could inject misinformation to facilitate scamming someone; they could insert ads; steal CPU-time/electricity for crypto-mining; they could just put gross porno on everyone's phone in a restaurant as a troll. Or something else. Or multiple things. 3. The original site being just plain-text doesn't really matter; the attacker can replace the entire thing without even contacting the