Why Libraries need HTTPS
Please write questions on cards provided
Jacob Hoffman-Andrews
GPG: E3E2 38BB 9AE1 D022 6B40 0CAD 3CBF 8C99 F1FA F31D
Goal:
Learn enough about HTTPS to make the case to use it on all of your library’s web sites.
What is HTTPS?
In Chrome:
HTTP:
HTTPS:
In Firefox:
HTTP:
HTTPS:
History of HTTPS
Originally used to protect passwords and credit card data.
Technologists later showed it’s necessary for all parts of a web site.
Also, it’s much easier now.
HTTPS Protects
Passwords
Catalog searches
Patron account data
HTTPS Protects Against
ISPs
Other patrons
Mass surveillance
HTTPS Doesn’t
Protect Against
Malware
Spam
Hacking
Why is HTTPS important for libraries?
What’s so hard about HTTPS?
Certificates
Get one from a Certificate Authority.
Used to be expensive, now free.
About 1-3 hours to set up.
Let’s Encrypt will make it easier!
Embedded Content
Images, Javascript, CSS
Mixed Content
When site is HTTPS, but Embedded Content is HTTP, site is not fully safe.
Images
(passive content)
Javascript & CSS
(active content,
blocked by browser)
Fixing Mixed Content
Find and replace http://mylibrary.org with https://mylibrary.org in HTML.
(double check all links before deploying!)
Some databases may need editing too.
Browser console can help diagnose.
Third party mixed content
e.g. http://use.typekit.net/xhz8mgf.js
Often, just change the URL to https://
Sometimes, resource is not available.
Copy locally or use different resource
Performance
No longer an issue.
HTTPS by default
Patrons should automatically get HTTPS site
even if they don’t know to ask.
See federal HTTPS-Only standard:
https.cio.gov
Browser extension for Chrome, Firefox, Firefox for Android, and Opera
Curated list of 14k+ websites that support HTTPS
but don’t make it default.
You can add your library to the list!
You can add your library to the list!
But this is a stopgap. Plan for HTTPS by default.
https://eff.org/https-everywhere
New, free Certificate Authority will automate certificate issuance and install.
Launches week of September 14.
Run by a non-profit, ISRG.
1-3 hours to install -> 5 minutes.
HTTPS and filtering