4 ms·
Why don't they mention HSTS? Seriously a very important safeguard against HTTPS stripping. Apart from that, my idea of what every web dev should know about HTT
by stephen_g 13y ago
Why don't they mention HSTS? Seriously a very important safeguard against HTTPS stripping.
Apart from that, my idea of what every web dev should know about HTTPS is use HTTPS for everything. The performance reduction is minimal and far less important than the security gain...
- pbhjpbhj 13y agoIs the performance reduction of the entire web with https really "minimal"? You've got extra overhead to setup the connection, extra processing to handle the encryption, no intermediate caching AFAICT. Clearly that has some impact - I'd expect it to be significant.
- stephen_g 13y agoOf course it has some impact. But it's not significant at all. Take a look at the link in the other comment: https://news.ycombinator.com/item?id=6102983 https://news.ycombinator.com/item?id=6102983
- mountaineer 13y agoIn general I agree that you should err on the safe side and do HTTPS everywhere. But, until you profile your site with/without HTTPS how do you know performance reduction is minimal? Do you have evidence to support such a blanket argument?
- stephen_g 13y agoYes, of course I have evidence. Refer to Google's experience in 2010 when they switched Gmail to HTTPS by default [1]: > On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10KB of memory per connection and less than 2% of network overhead. > If you stop reading now you only need to remember one thing: SSL/TLS is not computationally expensive any more. 1. https://www.imperialviolet.org/2010/06/25/overclocking-ssl.html https://www.imperialviolet.org/2010/06/25/overclocking-ssl.h...