3 ms·

Uh. What if a site doesn't need https? Like if it has just static pages with public content?

• agwa 12y ago
  Even a public static site needs HTTPS, for authentication and integrity: https://news.ycombinator.com/item?id=8146670 https://news.ycombinator.com/item?id=8146670
• augustl 12y ago
  Indeed. My static blog hosted on Linode behind Apache has survived a HN frontpage entry three times now. If I have to use HTTPS, does that mean I need a beefy server with lots of entropy?
  • agwa 12y ago
    No. My HTTPS blog hosted on Linode's smallest plan has survived a HN front page without any trouble. It's a myth that HTTPS causes significant resource overhead. As for entropy, your server only needs a small amount of entropy to seed a CSPRNG, and the CSPRNG takes it from there.
  • stephen_g 12y ago
    Nope! Google, from 2010: "On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10KB of memory per connection and less than 2% of network overhead." https://www.imperialviolet.org/2010/06/25/overclocking-ssl.html https://www.imperialviolet.org/2010/06/25/overclocking-ssl.h... Entropy is a different matter, but I believe pretty much all virtualisation platforms have ways to ensure the VMs have enough entropy sources - so it should be fine.
  • jgrahamc 12y ago
    See "Is TLS Fast Yet?": https://istlsfastyet.com/ https://istlsfastyet.com/
• jonknee 12y ago
  "Needing" HTTPS and supporting it are two different things.
• rythie 12y ago
  Even for wikipedia there are privacy implications of third parties knowing which page you are visiting and integrity concerns in places countries that want censor certain topics (e.g. China). I wrote about this a few months ago: https://rythie.com/blog/blog/2014/03/05/should-all-sites-use-https/ https://rythie.com/blog/blog/2014/03/05/should-all-sites-use...
  • Someone1234 12y ago
    That's a nice concept, but even with HTTPS the GET string is often leaked (e.g. referrer strings, tracking URLs (like Google's prior to this)). It is technically encrypted in HTTPS traffic but it isn't treated with very much respect so if you actually have access to all of the HTTP and DNS traffic surrounding a request you can often recover pages viewed. Additionally, in a lot of these countries computers come pre-installed with a government root CA which they can use to impersonate sites like Wikipedia (although the USG does this too!).
    • rythie 12y ago
      I note that the HTTP spec covers the leaking of referers: "A user agent MUST NOT send a Referer header field in an unsecured HTTP request if the referring page was received with a secure protocol." http://tools.ietf.org/html/rfc7231#section-5.5.2 http://tools.ietf.org/html/rfc7231#section-5.5.2 and that's how browsers implement it too. DNS doesn't give the page you were on. Whilst some systems might have a government root CA on it, it's still quite possible to remove that - it's pratically impossible to remove ISP level monitoring.
  • SnacksOnAPlane 12y ago
    HTTPS doesn't hide which page you're visiting, does it?
    • rythie 12y ago
      It does hide the page you're on and all the headers & content too.