4

Seems like https is becoming more and more popular these days. So my question is when is it appropriate to use https? What kind of advantages and disadvantages does it have?

Thank you!

2
  • Does this belong on SuperUser? Sep 3, 2010 at 14:58
  • 3
    I'm not a "computer enthusiast", I need this for my server.
    – Joshua
    Sep 3, 2010 at 15:05

7 Answers 7

10

I would argue it's always appropriate to use (or at least offer) SSL/https, and it's mandatory to use it when passwords, payment information, Social Security Numbers/other personally identifying information is being transmitted. It has an overhead, but in my eyes, the cost is always worth the benefit.

This is just my opinion, of course :-)

2
  • 1
    +1 for just do it. the overhead is pretty minimal on modern and even not-so modern hardware these days.
    – nedm
    Sep 3, 2010 at 21:52
  • 1
    Unless you run an immensely popular web service on very limited hardware, the overhead wouldn't be an issue, in which case you cant go wrong by using HTTPS for all traffic. And when you do, I guess the income would give you better hardware, which in turn, would again support HTTPS load. Its a win/win case. Nov 30, 2012 at 16:55
4

HTTPS usage is pretty much mandatory if you want to transfer anything sensitive, such as login information or other personally identifiable information (unless such data is your whole point to exist, like Facebook or LinkedIn).

More broadly, there are a variety of competing drivers for whether or not HTTPS is a good idea.

  • By encrypting everything, no one can watch the whole session on the wire. This is the most secure method! Great!
  • HTTPS transactions are a lot harder on a server resource-wise thant HTTP transactions, so you will need to start scaling horizontally a lot faster if you have a lot of HTTPS transactions. This gets expensive fast.
  • Really old clients still have trouble with SSL transactions due to CPU loading, which can reduce who can use your site.
  • Really old browsers have trouble with modern SSL transactions due to protocol support issues, which can reduce who can use your site.
  • Certain corporate networks disallow all but a white-list of domains for HTTPS support. They do this because they can't monitor the transactions to ensure company IP isn't leaking, among other reasons. This can reduce who can use your site when at work.

Depending on what you're planning on doing with your site, the above may or may not apply to you. It all depends on how far you plan to scale the site, and what your intended audience is.

3

This BizTech Magazine article looks like it covers all of the basics. Fundamentally:

HTTPS works in conjunction with another protocol, Secure Sockets Layer (SSL)

It sounds like a tautology but you want to use https when you need to send data securely. This will be anything like payment details, bank statements etc. Anything you don't want 3rd parties reading.

But when security is a must, HTTPS differentiates one sender and receiver from another. SSL takes the data, going or coming, and encrypts it. This means that SSL uses a mathematical algorithm to hide the true meaning of the data. The hope is that this algorithm is so complex it is either impossible or prohibitively difficult to crack.

2

Any time you are sending private information back and forth. If you don't use HTTPS, information is transmitted in plain text over the internet and is open to sniffing.

1

this is likely a good place to start: http://en.wikipedia.org/wiki/Transport_Layer_Security

but in short, when you want a secure connection.

1

HTTPS is used when you want to encrypt the data between your website and the user. HTTP by default sends data in plain text. This data can be sniffed by any attacker that's listening on the connection between the user and the website. Since this data is in plain text, the attacker can get hold of your credentials and other private information.

HTTPS is HTTP used in conjunction with SSL. With HTTPS, all the data in sent in encrypted form. Note that HTTPS doesn't prevent sniffing, it only makes sure that the sniffed data can't be read by an attacker.

So you'll want to use HTTPS whenever you want to encrypt data between your website and the users.

For more info. read the following wikipedia article. http://en.wikipedia.org/wiki/HTTP_Secure

1

I'd agree with Josh that encryption should be considered mandatory when transfering any data which could be used to facilitate identity theft. And for web access that almost inevitably means SSL.

I'm often surprised at the number of sites which go to appropriate lengths to protect credit card details and other private information, but fail to provide any protection for passwords - unfortunately a lot of users re-use the same password across lots of sites.

Similarly, you need to be careful and selective about surrogate identifiers such as cookies. Lots of people get this wrong. e.g. a lot of people think that setting cookies as SSL only protects against MITM attacks - but only if you also make sure that you're not vulnerable to session fixation. Having an SSL cerificate and HTTPS does not mean your site is secure. Most users can't tell the difference - however I can reading a study where they found that most users couldn't tell the difference in security between a site using HTTPS and one with a picture of a padlock on it.

There is a big overhead in response times and of course intermediate proxies cannot provide any caching. Load balancing is a PITA too.

You must log in to answer this question.