4 ms·
> For a public blog that doesn't accept submitting any information TLS is not about accepting information, it's about ensuring that the connection's encrypted
by drdaeman 11y ago
> For a public blog that doesn't accept submitting any information
TLS is not about accepting information, it's about ensuring that the connection's encrypted and authenticated.
It is still important to prevent unauthorized third parties from watching which articles you're reading. And it's still important that you know that you're reading a blog you expect to read, not a modified version served by someone else (although CA system isn't completely sufficient for this, at least it thwarts less-powerful adversaries from spoofing).
- StavrosK 11y agoSure, but it's a tradeoff between authentication and speed, in which many people may want to choose speed.
- kardos 11y agoI'm having some difficulty thinking of a scenario where, given the choice, I'd trade off authentication for speed. The information would have to be of so little value that it doesn't matter if the remote party gets what I send or if I get what the remote party sends.
- StavrosK 11y agoYou're assuming that the probability of interception is 100% In reality, the probability of interception is miniscule, but the probability of speed is 100%.
- interurban 11y agoThe probability of interception is massively higher than miniscule, see the recent wide scale hijacking of Chinese traffic to DDOS Github or ISPs inserting ads and tracking into responses. These types of attacks have been hypothetical for a long time, but we're starting to see real world impacts of not using https, and they aren't trivial.
- StavrosK 11y agoI made an events site for my city: http://www.tithess.gr/ http://www.tithess.gr/ The Greek government inserting ads into that site is very low on my list of concerns, but the additional 200-400ms on the first page load is much higher up. Am I correct in understanding your point as "there can be no conceivable case where two fewer TCP roundtrips would be worth the speed gain over the decreased security"?
- drdaeman 11y agoWeren't speed differences shown to be negligible? Unless someone care about a single extra round-trip timing, e.g. extra 10-300ms with 300 being quite a stretch? I'm sure it doesn't matter if a blog page opens in 40ms or 55ms - a reader won't tell the difference.
- StavrosK 11y agoI'm consistently seeing a 500ms difference between http://www.stavros.io http://www.stavros.io and http://www.stavros.io http://www.stavros.io with `time curl http://www.stavros.io` http://www.stavros.io`.