News for hackers. Stuff that matters.

A comment on Google to default to SSL version for logged in users. Parent comment

Re:Google to default to SSL version for logged in users by metageek on Tuesday October 18, 2011 @04:47PM (#3127098)
>HTTPS = more overhead than HTTP

Is that true? Most encryption schemes include compression (since compression removes redundancy, and redundancy is where cryptanalysts attack).

[ Parent | on HN ]
Re:Google to default to SSL version for logged in users by tonfa on Tuesday October 18, 2011 @05:53PM (#3127399)
And I guess if you use chrome(ium), you're already using an encrypted channel with SPDY anyway.
[ Parent | on HN ]
Re:Google to default to SSL version for logged in users by afdssfda on Wednesday October 19, 2011 @04:55PM (#3132047)
SSL handshaking causes more traffic. It may be compressed, but small pages like the Google main search page (the heaviest hit) may show an increase in traffic, even after compression is factored in. Here's one place where HTTP vs HTTPS is discussed, and a few quotes:

"Servers that are heavy on serving a fairly small set of static pages that can easily be cached in memory suffer from a much higher overhead... SSL handshaking is the major cost of HTTPS."

http://stackoverflow.com/questions/149274/http-vs-https-perf...

[ Parent | on HN ]