Ask HN: Why isn't HTTPS enough to protect your site?

Comments (5)

zahlman · 8h ago

The first lesson in cybersecurity (and I would imagine in real physical security as well) is that "protect your [asset]" is not well defined in a vacuum. You need to develop a threat model before you can sanely ask any questions about what actions you do or don't need to take.

HTTPS protects against one specific scenario: a third party is intercepting the communication. So it protects your users against those third parties (who might never forward the request to your site, and instead pretend to be your site; or they might spy on what they say to you or what you say back to them).

It does not protect against malicious users trying to hack your site directly, in any number of ways. Nor does it protect against people trying to hack into your server directly (bypassing the site entirely, although they might have the purpose of damaging your site). And it definitely doesn't protect against people trying to trick your users off-site, for example by sending them an email pretending to be from you.

jsheard · 9h ago

Huh? You're gonna have to elaborate a bit.

01-_- · 9h ago

why do we have to sanitize the input fields? why do we have to configure more headers? why even if we have https configured do we still have to add many other security elements?

codingdave · 8h ago

Take a step back and think about what security is in the first place - it is reducing the risk of people engaging in behaviors that you do not want. The list of those behaviors is not consistent between apps, although there is a large base of common concerns. HTTPS resolves one of those common concerns. No more, no less. Expecting one solution to all concerns is not a reasonable expectation.

jsheard · 9h ago

Because the point of HTTPS is to prevent man in the middle attacks. It isn't supposed to do everything.

Ask HN: Hackathons feel fake now – anyone else noticing this?

I built a pixel art editor after playing Octopath Traveler II

Ask HN: What are you working on? (April 2025)

Ask HN: Who wants to be hired? (May 2025)

Ask HN: Who is hiring? (May 2025)

Ask HN: I'm a New PostgreSQL Hacker – What Problems Do You Face with Postgres?

Ask ChatGPT for "Assistant Response Preferences" to see what it learnt about you

Tell HN: Incorporated my software company today

Ask HN: Best underrated way to get a job in tech during a hiring slowdown?

Building MapReduce (Based on Google Paper)

Ask HN: What Problem Would You Solve with Unlimited Resources? [May 2025]

Ask HN: How do I get over my fear of launching my product?

The engineering interview process is broken, AI cheating is exposing it faster

We cut CI emissions by up to 90% – by choosing where code runs

Ask HN: AI tools to help you learn faster (GitHub, books, PDFs)

LeetCode for Front End Engineers

Ask HN: Memory-safe low level languages?

VPNSecure deactivated all lifetime subscribers

Ask HN: Sold my company, parents passed away – feeling lost. What now?

Ask HN: CS degrees, do they matter again?

Ask HN: When do tariffs get levied? Who specifically charges them and how?

Ask HN: What's a good system to remember to wear my reading glasses at my desk?

Ask HN: Can't launch my Android app – Google couldn't verify your identity

Feedback on Tool I Created?

Payment processors shouldn't be able to charge through an expired card

Ask HN: Blocked by Cloudflare Infinite verify your human loop

Ask HN: Are there any apps to track grocery prices in local stores?

A affordable retrocomputer compatible with the C64

Ask HN: Why has there been a recent surge in criticism toward Next.js?

Ask HN: Why isn't HTTPS enough to protect your site?

Comments (5)