> If decryption has to be moved out into the CDN to support encryption of cat pictures, security has been reduced. That doesn't logically follow. The CDN doe

> If decryption has to be moved out into the CDN to support encryption of cat pictures, security has been reduced. That doesn't logically follow. The CDN doesn't have to start handling logins just because the "cat pictures" are now being served over HTTPS. > If you only encrypt login pages and such, and have a server with higher security handling them, you're at least protecting passwords and user identification It's impossible to provide meaningful security this way - if the pages linking to the login page aren't HTTPS, it's trivial to sslstrip them. Only a very small fraction of users will notice when this happens.