4 ms·
Why though - would anyone want to browser a site like news.ycombinator.com over SSL? The vast majority of web data is public data so encryption is of little va
by adamt 17y ago
Why though - would anyone want to browser a site like news.ycombinator.com over SSL? The vast majority of web data is public data so encryption is of little value, and due to the way SSL works, then there's arguably little value in SSL for authentication (if someone can hack the site, they can generally apply/install for a new SSL cert easily enough). In terms of privacy, SSL gains little - given that SSL breaks Host based virtual hosting, then accessing dodgysite.com's IP address lets a man in the middle know (almost) as much as about your browsing habits as accessing the site without SSL.
In terms of downside, SSL adds latency (ignore CPU time for now, it adds a further 2+ RTT times for the CLIENT_HELLO and SERVER_HELLO + cipher negotiation/key exchange on connection. Breaks (until SNI becomes about) HTTP Host based virtual servers. Breaks any web-caching by a proxy, and in many cases by the browser (most browsers don't use their disk cache for SSL content).
All that downside, for what upside? Yes - for the few forms where someone submits passwords or other private data, yes. But why on earth would you want to use SSL otherwise?
- JeremyStein 17y agoThere may be only a few forms that have passwords, but every request includes your session cookie. An eavesdropper could hijack your session. If I want to browse with TOR, it's pretty likely the exit nodes are sniffing my data. It kind of defeats the purpose of using TOR if I can't stay on HTTPS.
- axod 17y ago>> Breaks any web-caching by a proxy This is actually a pretty great upside often. Using SSL means that you can be reasonably sure that nothing is messing with your data in transit - caching, modifying, etc. Free wifi that modifies html pages and adds adverts? Just use ssl instead. Some firewalls that block based on keywords in pages etc - use SSL instead.
- wglb 17y agoIf I am reading stuff at the library or other public wifi (says right hear "The Library's wireless network is not secure") I don't want eavesdroppers to know.
- adamt 17y agoEven with SSL though, an eavesdropper would know: a) What site(s) you were accessing (the IP address is visible, and as it can't be a shared IP, a DNS lookup or SSL connect to that site should give them what site) and the length of time on each site. b) The approximate size of those pages, and the number of embedded items, so could quite probably and within reasonable time know what pages. c) If they knew your browser (through seeing non SSL traffic) they could probably know the length of the URL. Have you really gained anything through using SSL??
- wglb 17y agoThey don't see the content coming or going. That to me is pretty significant.