> But what about the performance improvements available by using shared, cached CDN resources? That doesn't really work over HTTPS, and the performance impact o

> But what about the performance improvements available by using shared, cached CDN resources? That doesn't really work over HTTPS, and the performance impact of missing out on that is substantial. SSL resources are still cached, not sure what you're getting at. > it often makes sense to serve static content (eg images) via HTTP while having the HTML on HTTPS. Why should the browser block (or even alert) about this? I MITM your users and insert a huge image saying "You need to confirm your bank account details, please call this number now <insert my phone number>" (etc.)