Ask HN: Just tested 200 gov websites and 2 were SSL-encrypted. What should I do?
I just tested over 200 websites from my country that are using our local .gov domain.<p>Only 2 (yes, two!) of them were properly SSL encrypted. About 50 of them used self-signed certificates, but none of those 50 tried to enforce SSL encryption by default. The rest of them cannot be accessed using https protocol at all!<p>The most interesting example I found was a site that has a self-signed certificate which expired in January 2013.<p>Some of them (30+) have contact forms posted on their sites. Most of those who have contact forms don&#x27;t have any kind of CAPTCHA recognition what so ever. About a third of them has newsletter subscription option and I found two unencrypted sites with login forms.!<p>I want to do something about this, but I want to be ethical about it. Of course, contacting every single one of them is not an option, since there&#x27;s far too many of them.<p>I&#x27;m thinking of writing a paper where I will address this issue and mimic some of the ways someone could exploit this fatal flaw like MitM-ing a .doc file coming from the server, MitM-ing contact forms and rejecting contact requests, injecting rogue HTML code etc. Of course, I would do these examples on my local network by using my secondary laptop as a victim and my primary laptop as an attacker.<p>But the thing is I&#x27;m afraid that my hard work will come to nothing and nobody important would read it nor do anything about it.<p>I would classify my country to be somewhere in between first- and third- world countries.