Author: MicahB

This blog is now accessible via more secure https (TLS).

The default site address is now https://j12.org/blog/

Here are lines in .htaccess file for this j12.org website that mean http requests are redirected to use a https connection

RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

but before that had to ensure had a certificate set up as well as https itself for the j12.org domain. My website hosting provider site5 sorted this for me on request. It was really straight forward with them. But there was a little bit of messing around to get the pages that previously had been on sub domains redirected to directories of single j12.org domain as I had not wanted to pay extra for wild card certificate. It was much less hassle with this shared hosting than when I had to install a certificate myself on vserver I manage for a large website. But even that was all pretty much do able following instructions.

The trend for more and more websites to use https over http is good. Some only use it in addition and so require using HTTPS-everywhere plug-in with rule for website being visited to be sure to use https over http when visiting site.

I have set up a rule for area of EducationCity.com use by one of my family as did not come with http-everywhere default rule set.

<ruleset name=”EducationCity”>
<target host=”stigandsten.educationcity.com”>
</target>
<rule from=”^http://stigandsten\.educationcity\.com/” to=”https://stigandsten.educationcity.com/”>
</rule>
</ruleset>

similarly for:
energynetworks
mumsnet (although layout does not work well as hard-linked to non secure version so browser locks unless over-ride, I wish there was a way for my browser to remember over ride as have the main text forum content secure is better than whole page being insecure)

Other rules not in default rule-set were created by an additional plugin that works them out:

mygreenstarenergy
libcom
indymedia.org.uk

All modern browsers support https/TLS so I recommend websites use it as default themselves so no need for plugins like HTTPS-everywhere..

Many websites I use do use https, but many don’t. I intend to write to those that run them and ask them to set up https if have not already and set it use by default. See my previous blog post on Encryption.

There are many ways I recommend to use and deploy, where you have opportunity, encryption, to keep your privacy, and encourage others.
This blog is not available via SSL/HTTPS but I am considering it [Update: now available via SSL: http://blog.j12.org/ ]. The extra cost including of certification of certificates are an issue though.
Although CAcert is a poor man’s alternative but gives most users poor experience but better than nothing and considering using for at least own blog thisisstaticsite.
While the recommendation use of HTTPS/SSL (padlock next to browser address bar) is established where using forms to supply personal information , there is now more to encourage us to adopt SSL/HTTPS everywhere: not just from the EFF but also Google encouraging use of SSL/HTTP everywhere (video).

It looks like it may get easier to setup websites to have encrypted access with Lets Encrypt project.

You can check how good SSL of a website is via:
https://www.ssllabs.com/ssltest/
http://toolbar.netcraft.com/site_report

and if you do run a web server check out: https://wiki.mozilla.org/Security/Server_Side_TLS

Email Server to Server encryption:
https://starttls.info/
https://ssl-tools.net/mailservers/

Email End to End encryption:
GnuPG
OpenPGP best practices
My old PGP page

Before passing personal details via a website:

You may wish check site domain ownership using whois:
https://whois.domaintools.com/

To check status UK companies:
https://ukdata.com/
which is website I use but there are others that nay have better interface and search to same data and if you need copies if annual accounts etc get them for free from Companies House or direct from company in question.

Details of US companies:
http://www.corporationwiki.com/

as well as general websearch.