News for hackers. Stuff that matters.

A comment on EFF: How to Deploy HTTPS Correctly. Parent comment

Re:EFF: How to Deploy HTTPS Correctly by btmorex on Tuesday November 16, 2010 @05:48PM (#1912050)
https incurs a heavy performance penalty for everyone. Server load isn't the problem; a large increase in latency for every single connection is.

Your typical blog is probably going to suffer even more from enabling https globally when compared to major sites because not as much effort has been put into combining js, css, and images into sprites.

[ Parent | on HN ]
Re:EFF: How to Deploy HTTPS Correctly by mootothemax on Tuesday November 16, 2010 @06:01PM (#1912098)
I wish I could uprate you with more than one vote.

Seriously, https performance sucks from start to finish. If the average user doesn't care about https, but does care about performance, who are they going to go with - you or your faster competitor?

[ Parent | on HN ]
Re:EFF: How to Deploy HTTPS Correctly by cookiecaper on Wednesday November 17, 2010 @02:54AM (#1913375)
Probably depends on if their account gets hijacked at your site or the site of your fastest competitor.

I agree that anonymous or non-logged-in activity has no need of HTTPS, but anything that's transferring cookies, passwords, or other important user or session information should be HTTPS.

[ Parent | on HN ]
Re:EFF: How to Deploy HTTPS Correctly by mike-cardwell on Wednesday November 17, 2010 @04:45AM (#1913648)
Google is currently working on something called "False Start" to reduce the number of roundtrips for an SSL connection to reduce latency. I believe there is already code in Chrome for this.
[ Parent | on HN ]
Re:EFF: How to Deploy HTTPS Correctly by chrisbroadfoot on Wednesday November 17, 2010 @01:39AM (#1913191)
The main detractor is inability for intermediate parties/networks to perform caching.

You can't cache something that's encrypted!

[ Parent | on HN ]