Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Seems like https is becoming more and more popular these days. So my question is when is it appropriate to use https? What kind of advantages and disadvantages does it have?

Thank you!

share|improve this question
    
Does this belong on SuperUser? –  Bart Silverstrim Sep 3 '10 at 14:58
3  
I'm not a "computer enthusiast", I need this for my server. –  Joshua Sep 3 '10 at 15:05

7 Answers 7

up vote 10 down vote accepted

I would argue it's always appropriate to use (or at least offer) SSL/https, and it's mandatory to use it when passwords, payment information, Social Security Numbers/other personally identifying information is being transmitted. It has an overhead, but in my eyes, the cost is always worth the benefit.

This is just my opinion, of course :-)

share|improve this answer
1  
+1 for just do it. the overhead is pretty minimal on modern and even not-so modern hardware these days. –  nedm Sep 3 '10 at 21:52
1  
Unless you run an immensely popular web service on very limited hardware, the overhead wouldn't be an issue, in which case you cant go wrong by using HTTPS for all traffic. And when you do, I guess the income would give you better hardware, which in turn, would again support HTTPS load. Its a win/win case. –  Tuncay Göncüoğlu Nov 30 '12 at 16:55

HTTPS usage is pretty much mandatory if you want to transfer anything sensitive, such as login information or other personally identifiable information (unless such data is your whole point to exist, like Facebook or LinkedIn).

More broadly, there are a variety of competing drivers for whether or not HTTPS is a good idea.

  • By encrypting everything, no one can watch the whole session on the wire. This is the most secure method! Great!
  • HTTPS transactions are a lot harder on a server resource-wise thant HTTP transactions, so you will need to start scaling horizontally a lot faster if you have a lot of HTTPS transactions. This gets expensive fast.
  • Really old clients still have trouble with SSL transactions due to CPU loading, which can reduce who can use your site.
  • Really old browsers have trouble with modern SSL transactions due to protocol support issues, which can reduce who can use your site.
  • Certain corporate networks disallow all but a white-list of domains for HTTPS support. They do this because they can't monitor the transactions to ensure company IP isn't leaking, among other reasons. This can reduce who can use your site when at work.

Depending on what you're planning on doing with your site, the above may or may not apply to you. It all depends on how far you plan to scale the site, and what your intended audience is.

share|improve this answer

This BizTech Magazine article looks like it covers all of the basics. Fundamentally:

HTTPS works in conjunction with another protocol, Secure Sockets Layer (SSL)

It sounds like a tautology but you want to use https when you need to send data securely. This will be anything like payment details, bank statements etc. Anything you don't want 3rd parties reading.

But when security is a must, HTTPS differentiates one sender and receiver from another. SSL takes the data, going or coming, and encrypts it. This means that SSL uses a mathematical algorithm to hide the true meaning of the data. The hope is that this algorithm is so complex it is either impossible or prohibitively difficult to crack.

share|improve this answer

Any time you are sending private information back and forth. If you don't use HTTPS, information is transmitted in plain text over the internet and is open to sniffing.

share|improve this answer

this is likely a good place to start: http://en.wikipedia.org/wiki/Transport_Layer_Security

but in short, when you want a secure connection.

share|improve this answer

HTTPS is used when you want to encrypt the data between your website and the user. HTTP by default sends data in plain text. This data can be sniffed by any attacker that's listening on the connection between the user and the website. Since this data is in plain text, the attacker can get hold of your credentials and other private information.

HTTPS is HTTP used in conjunction with SSL. With HTTPS, all the data in sent in encrypted form. Note that HTTPS doesn't prevent sniffing, it only makes sure that the sniffed data can't be read by an attacker.

So you'll want to use HTTPS whenever you want to encrypt data between your website and the users.

For more info. read the following wikipedia article. http://en.wikipedia.org/wiki/HTTP_Secure

share|improve this answer

I'd agree with Josh that encryption should be considered mandatory when transfering any data which could be used to facilitate identity theft. And for web access that almost inevitably means SSL.

I'm often surprised at the number of sites which go to appropriate lengths to protect credit card details and other private information, but fail to provide any protection for passwords - unfortunately a lot of users re-use the same password across lots of sites.

Similarly, you need to be careful and selective about surrogate identifiers such as cookies. Lots of people get this wrong. e.g. a lot of people think that setting cookies as SSL only protects against MITM attacks - but only if you also make sure that you're not vulnerable to session fixation. Having an SSL cerificate and HTTPS does not mean your site is secure. Most users can't tell the difference - however I can reading a study where they found that most users couldn't tell the difference in security between a site using HTTPS and one with a picture of a padlock on it.

There is a big overhead in response times and of course intermediate proxies cannot provide any caching. Load balancing is a PITA too.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.