Seems like https is becoming more and more popular these days. So my question is when is it appropriate to use https? What kind of advantages and disadvantages does it have?
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
I would argue it's always appropriate to use (or at least offer) SSL/https, and it's mandatory to use it when passwords, payment information, Social Security Numbers/other personally identifying information is being transmitted. It has an overhead, but in my eyes, the cost is always worth the benefit.
This is just my opinion, of course :-)
HTTPS usage is pretty much mandatory if you want to transfer anything sensitive, such as login information or other personally identifiable information (unless such data is your whole point to exist, like Facebook or LinkedIn).
More broadly, there are a variety of competing drivers for whether or not HTTPS is a good idea.
Depending on what you're planning on doing with your site, the above may or may not apply to you. It all depends on how far you plan to scale the site, and what your intended audience is.
This BizTech Magazine article looks like it covers all of the basics. Fundamentally:
HTTPS works in conjunction with another protocol, Secure Sockets Layer (SSL)
It sounds like a tautology but you want to use https when you need to send data securely. This will be anything like payment details, bank statements etc. Anything you don't want 3rd parties reading.
But when security is a must, HTTPS differentiates one sender and receiver from another. SSL takes the data, going or coming, and encrypts it. This means that SSL uses a mathematical algorithm to hide the true meaning of the data. The hope is that this algorithm is so complex it is either impossible or prohibitively difficult to crack.
this is likely a good place to start: http://en.wikipedia.org/wiki/Transport_Layer_Security
but in short, when you want a secure connection.
HTTPS is used when you want to encrypt the data between your website and the user. HTTP by default sends data in plain text. This data can be sniffed by any attacker that's listening on the connection between the user and the website. Since this data is in plain text, the attacker can get hold of your credentials and other private information.
HTTPS is HTTP used in conjunction with SSL. With HTTPS, all the data in sent in encrypted form. Note that HTTPS doesn't prevent sniffing, it only makes sure that the sniffed data can't be read by an attacker.
So you'll want to use HTTPS whenever you want to encrypt data between your website and the users.
For more info. read the following wikipedia article. http://en.wikipedia.org/wiki/HTTP_Secure
I'd agree with Josh that encryption should be considered mandatory when transfering any data which could be used to facilitate identity theft. And for web access that almost inevitably means SSL.
I'm often surprised at the number of sites which go to appropriate lengths to protect credit card details and other private information, but fail to provide any protection for passwords - unfortunately a lot of users re-use the same password across lots of sites.
Similarly, you need to be careful and selective about surrogate identifiers such as cookies. Lots of people get this wrong. e.g. a lot of people think that setting cookies as SSL only protects against MITM attacks - but only if you also make sure that you're not vulnerable to session fixation. Having an SSL cerificate and HTTPS does not mean your site is secure. Most users can't tell the difference - however I can reading a study where they found that most users couldn't tell the difference in security between a site using HTTPS and one with a picture of a padlock on it.
There is a big overhead in response times and of course intermediate proxies cannot provide any caching. Load balancing is a PITA too.