<!DOCTYPE html><html><head><title></title><style type="text/css">p.MsoNormal,p.MsoNoSpacing{margin:0}</style></head><body><blockquote type="cite" style="margin-top:0.125rem;margin-right:0px;margin-bottom:0.125rem;margin-left:0px;padding-top:0.2em;padding-right:0.75em;padding-bottom:0.2em;padding-left:0.75em;border-left-width:0.125rem;border-left-style:solid;border-top-left-radius:0.5rem;border-top-right-radius:0.5rem;border-bottom-right-radius:0.5rem;border-bottom-left-radius:0.5rem;color:rgb(43, 73, 125);background-color:rgb(232, 236, 242);font-family:"Source Sans Pro", sans-serif;font-size:17.145000457763672px;font-style:normal;font-variant-caps:normal;font-weight:normal;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;-webkit-text-size-adjust:none;-webkit-text-stroke-width:0px;text-decoration:none;"><div style="">A small organization that I work with (so far) refuses to<br></div><div style="">move to HTTPS, even though they require a *login* to use<br></div><div style="">their site.<br></div><div style=""><br></div><div style="">I'm trying to be diplomatic as possible, but I'd like to<br></div><div style="">convince them as simply and easily as possible.<br></div><div style=""><br></div><div style="">Does anyone here have any ideas?<br></div></blockquote><div><br></div><div>Goto the Google Chrome and Mozilla Firefox pages, pull the details of the future releases which plan to flag the sites as insecure. Share these with the webmaster.<br></div><div><br></div><div>But the best thing is to understand the reason why. Is it restrictions on a hosting package? lack of knowledge on how to deploy? Financial concerns? Performance overheads? Load balancer Issues? Not understanding the threats? Lack of time / resource to test and deploy? <br></div><div><br></div><div>When you understand these then maybe you can help the webmaster overcome them. </div><div><br></div><div>It might be a valid reason, the webmaster may want the site to flag as insecure, he/she may want users to think about what information they share with other users, to not reuse passwords, be lulled into thinking that because it is https then the server is secure?<br></div><div><br></div><div>... or they might just be a lazy toad!</div><div id="sig17781717"><div><br></div></div><blockquote type="cite" id="qt"><div><br></div><div><br></div></blockquote><div><br></div></body></html>