Spectacle: Enable end-to-end encryption on spectacleapp.com

Created on 29 Aug 2015 · 8Comments · Source: eczarny/spectacle

Per #435 spectacleapp.com is now served over HTTPS using CloudFlare's _Flexible SSL_ feature. Though this adds a level of protection that didn't exist before it's only a temporary solution.

Unfortunately I don't think GitHub Pages will place nicely with CloudFlare's _Full SSL_ feature so odds are the best way to go about setting up end-to-end encryption will be to use Amazon's CloudFront with S3 serving all static assets.

enhancement ★★

Source

eczarny

Most helpful comment

So my question would be why does it need SSL?

@redfox05 mostly to help reduce the likelihood of a man-in-the-middle attack. Without SSL it's much easier for a third party to intercept requests to spectacleapp.com and replace the links you find there with links to their own, potentially compromised, binaries.

While the scenario above may not seem likely I like knowing that I'm doing what I can to help prevent it from happening.

eczarny on 24 Sep 2016

👍5

All 8 comments

Relevant discussion: https://github.com/isaacs/github/issues/156 (tldr: not yet possible)

dsernst on 6 Sep 2015

GitHub Page actually works well with CloudFlare's _Full SSL_ feature (but not on the apex domain), just not _Strict SSL_. So if you move https://spectacleapp.com to https://www.spectacleapp.com. you can then enable _Full SSL_ without trouble. See https://github.com/isaacs/github/issues/156#issuecomment-110490178.

_Full SSL_ should provide more protection than _Flexible SSL_, and completely mitigates passive eavesdropping.

tonyztan on 10 Sep 2015

:+1:

Definitely something to consider as a temporary alternative until I get a proper SSL certificate and migrate away from GitHub Pages.

eczarny on 11 Sep 2015

I enabled Full SSL.

eczarny on 12 Sep 2015

@eczarny Awesome! Thanks for helping to encrypt the web.

tonyztan on 14 Sep 2015

Correct me if I got this wrong, but from what I understand, spectacleapp.com only serves to download the app and inform the user on what the app is. There does not seem to be any logged in section of the site, or anywhere you would enter sensitive information. So my question would be why does it need SSL?