I have no background in crypto stuff, but the main issues seem to be (a) SSL virtually requires buying certificates so small/hobby sites won't use it, (b) it involves multiple round-trips and latency is never going to go away unless someone invents faster-than-light communication, and (c) part of what makes encryption work is that it's computationally hard on today's hardware; when it's not, we move to a different algorithm that is, so the computational cost to using encryption versus not using encryption will always be there.
> SSL virtually requires buying certificates so
> small/hobby sites won't use it
startssl.com offers free SSL certificates valid in almost every browser, good for one year. I've been using them for my own site with no problems. Certificate cost is no excuse for continuing to use unsecured HTTP.
> it involves multiple round-trips and latency is never
> going to go away
Assuming reasonable protocol design (somewhat problematic for HTTP/1.0, better in /1.1 and SPDY), additional round trips are only a factor for the initial connection setup. Later requests can re-use the existing SSL session.
> part of what makes encryption work is that it's
> computationally hard on today's hardware
Encryption is based on being computationally expensive for a third party. The computational load on the communicating parties is negligible, particularly with modern CPUs. From http://www.imperialviolet.org/2010/06/25/overclocking-ssl.ht... , Google experiences CPU overheads of less than one percent:
> On our production frontend machines, SSL/TLS accounts
> for less than 1% of the CPU load, less than 10KB of
> memory per connection and less than 2% of network overhead.
> startssl.com offers free SSL certificates valid in almost every browser, good for one year
startssl certs aren't trusted by my browser (or maybe the os?), so ssl's identity authentication for startssl is void. It's still better than no cert since ISPs can't detect what certs my browser trusts, thus wont make stupid moves, probably.
If you can use more widely recognized certificates, please do.
I've debated purchasing a wildcard certificate from them but was afraid of having users whose browsers didn't trust the root CA. May I ask what combination of OS and browser you're using?
> part of what makes encryption work is that it's computationally hard on today's hardware; when it's not, we move to a different algorithm that is, so the computational cost to using encryption versus not using encryption will always be there.
It's computationally hard to crack. To be useful, it necessarily has to be easier to use than to circumvent.
https is no longer "rigid and costly" in a technical sense
On a recent website I did my own tests and saw a 2.5% increase in request speed (between http & https). Basically if you aren't a super huge site you aren't going to see any difference. I use https on all my sites, it's just simpler in the long term and you circumvent a lot of problems with security.
