> SSL virtually requires buying certificates so
  > small/hobby sites won't use it

startssl.com offers free SSL certificates valid in almost every browser, good for one year. I've been using them for my own site with no problems. Certificate cost is no excuse for continuing to use unsecured HTTP.

  > it involves multiple round-trips and latency is never
  > going to go away

Assuming reasonable protocol design (somewhat problematic for HTTP/1.0, better in /1.1 and SPDY), additional round trips are only a factor for the initial connection setup. Later requests can re-use the existing SSL session.

  > part of what makes encryption work is that it's
  > computationally hard on today's hardware

Encryption is based on being computationally expensive for a third party. The computational load on the communicating parties is negligible, particularly with modern CPUs. From http://www.imperialviolet.org/2010/06/25/overclocking-ssl.ht... , Google experiences CPU overheads of less than one percent:

  > On our production frontend machines, SSL/TLS accounts
  > for less than 1% of the CPU load, less than 10KB of
  > memory per connection and less than 2% of network overhead.

> startssl.com offers free SSL certificates valid in almost every browser, good for one year

startssl certs aren't trusted by my browser (or maybe the os?), so ssl's identity authentication for startssl is void. It's still better than no cert since ISPs can't detect what certs my browser trusts, thus wont make stupid moves, probably.

If you can use more widely recognized certificates, please do.

http://en.wikipedia.org/wiki/Comparison_of_SSL_certificates_... Claims StartSSLs Free certs are valid in IE>7, Firefox>3, Safari and Android>2.1. I can personally verify they're valid in Google Chrome.

Which browser/OS combo are you using?

I've debated purchasing a wildcard certificate from them but was afraid of having users whose browsers didn't trust the root CA. May I ask what combination of OS and browser you're using?

> startssl.com offers free SSL certificates valid in almost every browser, good for one year

True, but the last time I tried them the UX was a nightmare.

I've just started using them and yes, the UX still isn't great.

On the other hand, they are two orders of magnitude cheaper than Symantec (nee Verisign)...

> part of what makes encryption work is that it's computationally hard on today's hardware; when it's not, we move to a different algorithm that is, so the computational cost to using encryption versus not using encryption will always be there.

It's computationally hard to crack. To be useful, it necessarily has to be easier to use than to circumvent.

https is no longer "rigid and costly" in a technical sense On a recent website I did my own tests and saw a 2.5% increase in request speed (between http & https). Basically if you aren't a super huge site you aren't going to see any difference. I use https on all my sites, it's just simpler in the long term and you circumvent a lot of problems with security.