> Why bother with the extra security overhead for a simple blog with no user login and a basic comment system. Can you clarify what you mean by "security overh

> Why bother with the extra security overhead for a simple blog with no user login and a basic comment system. Can you clarify what you mean by "security overhead"? In 2018, there is virtually no performance difference between HTTP and HTTPS. For example, see performance evaluations and comparison overviews [1] and [2]. It's also very easy to set up HTTPS. If you have the technical capability to administer your own Apache or Nginx server, setting up HTTPS doesn't require much more configuration. Let's Encrypt is straightforward to use. If you're setting up a blog on WordPress or Squarespace, it's a matter of flicking a switch (or the choice has been conveniently made for you). As for your idea regarding content digests, how do you propose to implement this? They need to be signed, sure, because an attacker intercepting my connection could just supply their own hash digest corresponding to the content. But then where do I obtain the public key corresponding to the site? How do I grab that key in such a way that I know it's the correct one? You'll find that any protocol you can device to safisfactorily resolve this problem will substantially reimplement TLS itself. ____________________________ 1. https://www.httpvshttps.com https://www.httpvshttps.com 2. https://istlsfastyet.com https://istlsfastyet.com