Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am going to be distributing a file to people after they purchase it. I'm trying to determine whether I should use http or https to deliver the actual file.

  1. My hosting plan is pay-as-you-go. Will bandwidth cost more for https since it's encrypted? Example: will a 100MB file end up using more than 100MB of bandwidth?

  2. I understand that http is faster, but is https similar in speed after all the initial server handshake stuff? (note: I am using CDN)

  3. My URL given to download the file will contain a signature, etc. to verify that only the person who purchased can download. Should I use https to keep this signature secure?

  4. If I were to use http, would the file transferred be secured from hackers?

Note, I have already read this question

share|improve this question
1  
If you are using a CDN to distribute files I think you may find that there is a significant increase in cost for an HTTPS CDN. HTTPS generally requires either a special certificate or a separate IP for each site served both which have an associated cost. –  Zoredache Jan 5 '12 at 18:27

3 Answers 3

up vote 3 down vote accepted

My hosting plan is pay-as-you-go. Will bandwidth cost more for https since it's encrypted? Example: will a 100MB file end up using more than 100MB of bandwidth?

No. The block or stream ciphers that are used by SSL/TLS to encrypt the data in transit will add, at most, a handful of bytes to the file's transfer size.

I understand that http is faster, but is https similar in speed after all the initial server handshake stuff? (note: I am using CDN)

Yes. Encryption takes extra CPU time on the server and on the client, but on modern CPUs the impact is fairly low. As long as your client and server are not CPU-bound, the encrypted transfer will be just about the same speed as unencrypted.

My URL given to download the file will contain a signature, etc. to verify that only the person who purchased can download. Should I use https to keep this signature secure?

Yes, the URL being visited is secured end-to-end from the client to the server by SSL/TLS - the exception here is that the hostname part of the URL is not necessarily secure, but in your case that should not be an issue. As long as the client system is not compromised or using a malicious proxy server, the data is safe in transit.

If I were to use http, would the file transferred be secured from hackers?

No. HTTP traffic is completely in the clear; anyone on the same network segment as the client downloading the file (or the same coffee shop wifi), as well as anyone with access to any of the network infrastructure between the client and server is able to see the full request and full response. SSL also provides additional assurance to the client that the system that they're connecting to is what it says it is, instead of a potential attacker's server. If the data being transferred in the download or the URL to request the download is sensitive, then encrypt it.

share|improve this answer
    
Thank you very much for the great answer. Using http, I now understand that someone can view the file, but can they modify the file (or modify the credentials), thereby hindering the person from downloading properly? –  Hope4You Jan 5 '12 at 18:32
1  
@Hope4You It's a trickier attack to pull of than just seeing the communication, but yes, it can be done - an attacker that's able to intercept the communication and inject their own spoofed communication could represent themselves as the client when talking to the server and as the server when talking to the client, modifying any part of the HTTP conversation at their whim. HTTPS not only includes the encryption for confidentiality, but also authentication and non-repudiation so that you know you're talking to who you think you're talking to and not an attacker. –  Shane Madden Jan 5 '12 at 18:34
  1. Yes... encryption adds some overhead... but usually very minimal.
  2. HTTP is faster as it doesn't have to do the initial handshake... but after that... the connection is already established so the latency is the same. (minus the time for encryption/decryption which is minimal)
  3. Not sure what you mean here 100%... If you mean you're going to give users a unique URL to download the file... everyone will have it in a short period of time. Simply trying to hide your file's address won't hide anything. If you mean unique username/password for each user... that's probably a good idea. If you're going to use HTTPS... it's a good idea to complete the whole transaction through https unless you have some specific need not to.
  4. HTTP is sent in clear-text. Nothing can make this secure. Anyone in the middle can have full access to your file. HTTPS can make this MUCH more secure... if done right.

I really hate to say this, but you really sound like you have no clue what you're doing... You really should hire a consultant or a development company to implement what you're doing.

share|improve this answer

So will the file be store on a generic site some where that indexed, or are you going to use some sort of auto-url generator to post the file? Will the file be accessiable anonomously, or will they have to provide credentials?

I would say if you're not sure, go with SSL to be on the safe side, but do understand what SSL's main purpose is. It's to encrypt the conversation (ie the transfer process). So, if you had user logging into download that file, you'd want SSL so thier login credentials are secure. If you have a file that contains confidential info, then use SSL to protect it during the transfer. Do know, that if you don't have a login for that file, even if you have SSL for it, if someone fiures out the URL, they'll be able to download it without issue.

And yes, SSL protects your data from being intercepted by hackers, but nothings 100% secure.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.