> the overhead The computational overhead is negligible. This simply isn't a credible argument against HTTPS. Netflix send petabytes of data over HTTPS. There

> the overhead The computational overhead is negligible. This simply isn't a credible argument against HTTPS. Netflix send petabytes of data over HTTPS. There's no excuse for anyone else. > A medical site is different to a static html site like listed in the post. Different in degree, but not in category. Your browsing habits on ordinary non-sensitive sites can still be used to profile you. > ISP regardless of SSL know which sites I’m visiting They can still look at the destination IP, yes, and they can probably look at your DNS requests, as secure DNS is currently only rarely used. It's still worth doing. Knowing that someone went on Wikipedia tells you almost nothing. Knowing the specific pages they went to, tells you a great deal. > It’s there in the HTTP host header regardless of SSL or not. That's not the case. HTTPS encrypts all headers. > transit security can easily be encrypted without SSL The easy solution is HTTPS. > people are too lazy to encrypt their content within the application. A universal principle in cyber-security: rolling your own crypto scheme is generally a terrible idea. As I said, Steam and Apt are the exceptions; they use plain HTTP for delivery, and implement secure file verification using hashes. Even here, with competent people running a simple delivery scheme, there can be serious security issues [0]. When it comes to web applications, you cannot implement your own secure delivery, for the obvious reason: an attacker can just replace your code. Sites like LastPass.com still have to use HTTPS to deliver the web app. Even if it could be done, there would be no reason to. The browser offers you HTTPS, so you get a carefully designed, battle-tested protocol, and a carefully designed, battle-tested implementation. You are entirely shielded from all the complexities. You aren't going to do better in JavaScript. > When I want a pure server with nothing other than my application I don’t want to download a certificate bot, install (lang) and let it mess with my configuration. It's additional configuration work, yes, but I don't accept that it's much of an argument against HTTPs. You still have totally free choice over your tooling and languages. > I don’t dismiss that HTTPS is important but I feel platform is flawed. You've not presented a single good argument against the technical merits of HTTPS. > Owned by corporate greed. It’s security based upon pay us money or else model. You can get certs for free. This isn't new. [1] [0] https://justi.cz/security/2019/01/22/apt-rce.html https://justi.cz/security/2019/01/22/apt-rce.html [1] https://en.wikipedia.org/wiki/Let%27s_Encrypt https://en.wikipedia.org/wiki/Let%27s_Encrypt