4 ms·
> The SSL handshake alone can take as long as a third of a second. Is this true? If so, then it's a good reason for me not to enable SSL/TLS on my sites that d
by fouric 6y ago
> The SSL handshake alone can take as long as a third of a second.
Is this true? If so, then it's a good reason for me not to enable SSL/TLS on my sites that don't need it (e.g. read-only documents or blog posts).
- forty 6y agoAll websites need SSL, even if the content is not sensitive. Someone could inject something like "I'm raising money for a charity, send money >>HERE<<, thanks!" and people that goes on your non sensitive website could get tricked. That's just a simple example, but a more competent attacker would also use your unencrypted traffic to inject malicious code that target some browser vulnerability, or make the visitor download a malware, ...
- labcomputer 6y agoWhat's to stop an adversary from modifying the page in-transit to load malicious javascript?
- ex3ndr 6y agoIt could take much longer. Ping between US and EU is ~100-150ms. If TLS is an old one with 3 round trips it is a full second.
- wongarsu 6y agoA single ping to the other side of the earth takes a theoretical minimum of 133ms, and more realistically about 300ms. An SSL handshake has to exchange data twice (thrice?), so even without processing delays at all we easily get a third of a second or longer if you're far enough away. That said, SSL is useful on read-only documents: it provides integrity. Without SSL anyone between your server and the end user can just change the page content, whether that's for misinformation, false-flag-attacks, inserting malware, scanning for censored content (which is known to happen) or for inserting ads (which also happens).