Hacker News new | past | comments | ask | show | jobs | submit login

the default noted there seems fine? if HTTPS, then GA uses HTTPS, if HTTP, GA uses HTTP

with firefox adding in mixed-content-complaining not too long ago [1], along with IE having it for a while, and apparantly chrome having it too, its best to match protocol to minimize issues for the user

[1]: https://blog.mozilla.org/tanvi/2013/04/10/mixed-content-bloc...




Browsers only complain if you go from HTTPS=>HTTP, not the other way around, so there is no mixed content warning. The article itself, hosted on Blogger, demonstrates this if you check the source code -- whilst the website is HTTP, it uses JS hosted on HTTPS, with no mixed content issue.

To reiterate on the issue with HTTP default, the issue is that Google Analytics being HTTP on all HTTP sites results in a far easier man-in-the-middle target. An attacker only needs to eavesdrop on messages being sent to the Google Analytics endpoints, a far smaller and simpler task than observing and parsing all HTTP traffic.

As such, a default of HTTP even if the website itself uses HTTP is something I'd term a major issue. An ISP or government agency could track the web traffic of an enormous number of users without having to perform any real processing of their own. Admittedly, they'd only see a subset of what Google sees, but that's still a lot.


If only..... there are numerous browser bugs out there where HTTP=>HTTPS ends with warnings or failures.

e.g. in IE9, see point 7 on http://blogs.msdn.com/b/ieinternals/archive/2010/05/13/xdoma...


It doesn't show up if you have an HTTPS script on an HTTP page.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: