Optimizing HTTPS performance

Re:Optimizing HTTPS performance by hannob on Sunday January 31, 2016 @03:13PM (#11007845)

The performance benefit would be hardly measurable. First of all the performance impact of HTTPS in general is almost irrelevant. Second, even if you care about that irrelevant performance impact, unless you transmit really large files the biggest hit is from the asymmetric part. You'd still have that with a NULL cipher.

You would also introduce a significant risk. How would you communicate your "authenticated, but not encrypted" connection? Looks like HTTPS? Like HTTP? Something new? Confusion for the user (who doesn't know the finer details between authenticity and secrecy) is guaranteed.

In the end you'd introduce a less secure variant of HTTPS without any significant advantage. And you add complexity and the risk that it gets used in situations where secrecy matters, but the people responsible didn't properly think about it. Doesn't sound like a good idea to me.

[ Parent | on HN ]

Re:Optimizing HTTPS performance by chetanahuja on Sunday January 31, 2016 @05:51PM (#11008549)

"First of all the performance impact of HTTPS in general is almost irrelevant."

  Wonder why you through in the "in general" caveat in there? Is it because HTTPS 4 way handshake (2 full roundtrips) is actually an enormous hit on performance on high latency networks. And what are these high latency networks? Mobile networks of course.

[ Parent | on HN ]