4 ms·
What is the downside of having it all secured? On top of that, having only data that must be secure makes it very apperent to anyone looking that 'hey this is
by mhurron 11y ago
What is the downside of having it all secured?
On top of that, having only data that must be secure makes it very apperent to anyone looking that 'hey this is totally important information.' Having everything encrypted makes all encrypted traffic seem perfectly normal.
- josteink 11y agoHTTPS brings complexity. In lots of cases I dont want that complexity. Sometimes that complexity gives rise to (heartbeat) bugs, problems and stability issues. When it doesn't, it always leads to more work. I want to be able to setup a website, access that website instantly without having to meddle with getting SSL-certs, or creating my own self-signed certs. Sometimes you want consumers to be software, components (IoT thingies) which doesn't always have an up to date crypto-stack or have a crypto-stack at all. Getting them to accept the HTTPS website can result in all kinds of issues (ref wget --no-check-certificate, even on modern Linux systems)... In general, getting HTTPS up and running is about an order of magnitude more work than plain HTTP. And if you don't need it, why should you be forced to put in the effort? The answer is obvious: You shouldn't. Because you don't need HTTPS everywhere. You don't. That's a purely factual statement. I cannot for the life of me see how anyone has a problem accepting that.