SSL | Dangerous Common Sense

The Cobbler’s Children Get New Shoes

Our business website looked great when it went live in 2002. It was modern, clean, quick-to-load, and full-featured. We did updates and edits throughout the years, but the basic layout and functionality was rooted in standards and technology of the early new century.

The original home page is shown on the right (and click on the picture to go to the actual old site).

But, we’re not in 2002 anymore. It was way past time to create an updated Ozdachs.biz, and we were happy to go live with a new look in early July.

Here are 4 major changes we made… and ones you should consider doing, if your site is 16, 10, or even 6 years old!

Responsive Design

Responsive design means that your site responds (displays) differently depending upon the layout and size of the user’s screen. Graphics will change size and columns will break differently depending on what type of device your visitor is using. Your pages will look different on desktops, tablets, and cell phones.

For some industries, over half of all website visitors are using their cellphones, so making pages that look look and work well on small screens is important.

Responsive design lets your web pages display on the phone without making the user scroll or manually resize the screen. Users like responsive sites a lot. They don’t like to have to scroll left and right to see what’s there.

Moreover, Google ranks sites that are NOT responsive lower in search results. If you’re hoping that new visitors will discover your site when they look up your keywords on Google, you need to have a responsive site.

Mobile Test Results for Ozdachs.biz

Want to see if your current site is responsive?

And then see if the small formats are user-friendly: Use Google’s free testing tool.

Larger and More Complex Graphics

Fifteen years ago web designers had to worry about the size of photographs and functional code on their site because download speeds were low. Remember the hot technology of DSL? The top DSL speed was 128 kilobits per second to 3 Megabits per second (Mbps). Big pictures, maybe 8 Megabits in size, could make your website take forever to display.

Most people now get 10, 20, 100, or even 1000 Mbs from their Internet Servic Provider!

Users and search engines still care about speed, and Google boosts your site in search results if it loads in a reasonable amount of time. But, with speeds 100 faster than they were a few years ago, images can be larger and you can do some fancy displays with pictures and text.

You want larger photos and more interesting graphics — properly focused, they grab the attention of your visitors.

WordPress for Code Management

Initially all of Ozdachs’ sites were simple HTML sites with maybe some JavaScript written for navigation or simple image swapping. To publish a site or to make changes, you had to have a What You See Is What You Get (WYSIWYG) HTML authoring tool like FrontPage or Dreamweaver on your computer. You’d make your changes locally and then upload the HTML code to your hosting service.

Now, up to 30% of website are developed using the open source code management system WordPress. WordPress is constantly being updated and improved. Third parties are writing tons of plug-in applications to increase the functionality of WordPress sites. In addition, scads of developers have created templates that sit on top of WordPress and let you apply and extensively customize prefabricated websites and web pages.

WordPress sites live on the hosting service, not on any one person’s computer. With proper security, your developer or you can update your site content from anywhere with an Internet connection. You do your edits using a web browser. You go to your site, enter in your authoring credentials, and make your changes. There is no special software required on your computer.

WordPress originally was known for supporting blogs like this one. But, now entire sites are built on WordPress.

Ozdachs uses WordPress —and currently the Avada template — for most of its clients. The choices of looks and features which can be selected is rich. Our web design home page shows a selection of client sites, and all but one of them are WordPress sites using Avada.

Frankly, we couldn’t offer the range of looks and functions to our clients without relying on whiz-bang products from third parties. Developers and companies are producing more reasonably-priced tools for the WordPress platform than for any other offering. So, we are WordPress fans.

HTTPS Protocol

When your old site was created, chances are your hosting service only delivered pages to visitors using Hypertext Transport Protocol, and the site’s address in web browsers showed up as “http://www.yoursite.com”.

The standard now for websites is now Hypertext Transport Protocol Secure or HTTPS. This means that your website’s connections with your visitors are encrypted and that your site has been verified as real by a third-party issuer of security certificates. Check out this discussion of what HTTPS is and why you want it.

Most of Ozdachs clients collect no sensitive data from their visitors. Getting a security certificate and delivering content by HTTPS might seem like overkill.

However, Google threatens to penalize all sites that are not HTTPS by displaying them lower in search engine results. And, also, some of your users will be reassured by seeing the padlock icon and a “Secure” indication in the browser’s address field when they use your site.

We decided to pay for a upgraded SSL certificate for our business site so visitors know we know the technology and understand that we can be trusted.

Check Out Our New Shoes

That’s it! Our four big changes:

1. Responsive Design
2. Larger and Complex Graphics
3. WordPress Base
4. HTTPS protocol

The leap from a 2002 look and a 2018 website is a big one.

We like the fancy look look of our new shoes.

Check out Ozdachs’ Internet Consulting business site, and let us know what you think and if you have any questions on what we’ve done.

What’s Heartbleed and Why Do You Care?

You know how you’re told to put your private social security number or credit card information only into sites that are secure? Their site address is https:// instead of just http:// . Your browser will display a lock icon, turn something green, or give you another indication that what you send in cannot be stolen by third parties?

Well, it turns out these https:// sites are not secure at all.

Monday one of the biggest suppliers of encryption code said that their widely used library has a flaw in it which allows anyone to look at 64,000 characters that is in the host server’s memory. Your retirement account username and password and social security number might be part of the 64kB of information a passing bad guy looked at. Or, the username and password to Gmail account could have been scraped and sent to Bad Guy Central.

And, the theft of your information would leave no trace on the victimized computer server at Wells Fargo, Bank of America, Chase, or wherever.

The Ugly

This bug has been named “Heartbleed” in a nerdy reference to the communications heartbeat code that it lives in. Cute name, but I’ve seen statements that the seriousness of Heartbleed on a scale of 1 to 10 is 11.

The geek world is uniformly saying that this problem is very awful.

On the Other Hand

I cannot find a report from anyone anywhere that says this bug is the apparent source of any loss of data, money, or privacy. The bug was discovered by honest programmers who notified the people responsible for the faulty code. A patch was immediately released, and most larger sites have already updated their servers.

2 Actions You Must Take!

Still, the Heartbleed problem is real, and there is a potential that some bad guys have broken into systems and have used, or have stored for future use, the information they stole. They could have broken into your bank just as you logged on, which would give them your username and password. They could have done the same with your investment firm, credit card company, or many other places you enter data you want to keep private and secure.

So, you need to change your passwords for every secure site. Today.

I suggest using LastPass for creating strong new passwords and tracking them. (See this post for more information on why.) But, whether your use LastPass or manage your passwords manually, at the very least add or change one character for all of your current passwords.

But, first, make sure that your secure service has patched its software. If not, change the password now, do not use the site for secure transactions, and check again tomorrow. Now that the bug is well known and easy to exploit, your chances of having your data stolen on an unpatched server is much, much greater than it was last week.

C/net recommends http://filippo.io/Heartbleed as a place to test whether the Heartbleed patch has been installed. Use it!

References To Read

Here are sites I used for this post. Check them out for more information.