Yes, but back then SSL/TLS wasn’t a requirement to publish anything on the web. You just needed a domain, and IP and a web server. The minimum bureaucracy you have to do now is much greater.
replyIt's still not a requirement. Most modern browser will pester you about it, but it can be circumvented. And it was already a bad idea to publish anything without encryption at the time, and it still is. The issue with SSL/TLS and in general with most encryption scheme (even e2e) is bootstrapping trust, and to my knowledge, there is no perfect way to deal with that. The CA system as its pros and cons and LE at least fixed the biggest flaw for the web (good luck if you need a certificate that can't use an ACME challenge, like most thing non-web tho').
reply> And it was already a bad idea to publish anything without encryption at the time, and it still is
replyWhy?
Famously, sites like Facebook didn't use or enforce SSL/TLS for a long time, and people were constantly getting session hijacked when using public WiFi. Even if all you publish is static content, encryption still makes your site robust against malicious content injection from e.g. ISPs or malicious access points.
replyBecause anyone who controls any system on the network path between -- or your DNS -- can read, or more importantly ALTER the content. This includes javascript malware, redirecting links to phishing sites, etc. It's honestly disrespectful to your site visitors not to provide TLS.
replyIt's still not a requirement
replyIt de-facto is. All major browsers will yell at the user saying in more or fewer words that the site is dangerous to view if it’s not connecting over https.
Browsers didn't defame websites for not using HTTPS before Let's Encrypt.
replyBrowsers did devote a ton of chrome space to showing off E.V. certificates though, which had approximately the same effect.
reply