4 ms·
> These properties are useful for all of our applications, all of the time — not just when passwords or personal information are involved. Bingo. HTTPS only is
by hawkice 12y ago
> These properties are useful for all of our applications, all of the time — not just when passwords or personal information are involved.
Bingo. HTTPS only is a much better way to operate web properties these days -- the only downside is a fairly marginal investment of money and time.
What's interesting is to see the headaches people experience with mixed content warnings/errors before they move to the Light Side of the Force (I've been at places where this is a substantial undertaking/roadblock).
- moron4hire 12y agoYes! Every single one of these issues is, on its own, enough reason to go HTTPS-only. I finally did it a couple of months ago, and it wasn't that hard to learn, and now that I know, it's just part of my setup process. Another reason to add to the list: not having to repeatedly ask the user for permission to access advanced HTML5 APIs. Stuff like streaming media, GPS location, background notifications, and speech recognition. If you're making an HTML5 SPA, HTTPS is essential.
- umanwizard 12y agoThose aren't the only downsides. The other downside is dramatically increased first byte latency due to the handshake.
- konklone 12y ago> Those aren't the only downsides. The other downside is dramatically increased first byte latency due to the handshake. The latency increased, but it doesn't have to be drastic. Ilya Grigorik has a great piece on how to get the handshake down: https://www.igvita.com/2013/12/16/optimizing-nginx-tls-time-to-first-byte/ https://www.igvita.com/2013/12/16/optimizing-nginx-tls-time-... We turn on as much of that stuff as we can for our servers, and I'm pretty happy with it.
- tracker1 12y agoA lot of that can be mitigated with SPDY/HTML2 support, since the channel can be multiplexed for additional content requests.
- heydonovan 12y agoI'm pretty sure you meant SPDY/HTTP2.