Does my site need HTTPS?

Re:Does my site need HTTPS? by dreamsbythelake on Monday January 31, 2022 @10:29PM (#30158294)

HTTPS (TLS v1.3) does add ~100% overhead. I personally prefer simple HTTP sites, but everyone is scared of "Not Secure" message in address bar ... So we all have to pay that penalty, even on static sites, easily checked against WayBack Machine or Tor service.

[ Parent | on HN ]

Re:Does my site need HTTPS? by kadoban on Monday January 31, 2022 @10:50PM (#30158414)

That's a lot of overhead. There's no way that's right for anything like common behavior/content.

[ Parent | on HN ]

Re:Does my site need HTTPS? by dreamsbythelake on Tuesday February 01, 2022 @02:07AM (#30159486)

Yes, I was also surprised to see that. Just opened TLS website in Firefox, Inspect->Network->site's home page->Timings. -> TLS Setup: 84ms, content generation+wait+receiving: 30ms ... Fun, huh? :-)

/e: non-CDN site, hosted on EC2, safe ciphers+hash algos without crypto HW accelerators etc. Average business website. With WordPress it is even worse. The CDN lets us terminate TLS and fetch origin in plain text + optimisations on crypto etc.

[ Parent | on HN ]

Re:Does my site need HTTPS? by purerandomness on Wednesday February 02, 2022 @04:19PM (#30184211)

Why would anybody care about performance more than caring about malicious code being injected?

Very strange way of thinking.

[ Parent | on HN ]