I don't support more HTTPS because of the cost of static IPs on EC2 (i.e. ~72/mo)
Huh? There is no cost for an elastic IP address when it is in use.
Ask HN: Why don't we see more HTTPS? Is CPU an issue?
11–20 of 32 posts
Re: Ask HN: Why don't we see more HTTPS? Is CPU an issue?
#12I don't support more HTTPS because of the cost of static IPs on EC2 (i.e. ~72/mo)
Elastic IPs are $7/mo. only if they are unused. They cost nothing if attached to a running EC2 instance.
Re: Ask HN: Why don't we see more HTTPS? Is CPU an issue?
#13Why though - would anyone want to browser a site like news.ycombinator.com over SSL? The vast majority of web data is public data so encryption is of little value, and due to the way SSL works, then there's arguably little value in SSL for authentication (if someone can hack the site, they can generally apply/install for a new SSL cert easily enough). In terms of privacy, SSL gains little - given that SSL breaks Host based virtual hosting, then accessing dodgysite.com's IP address lets a man in the middle know (almost) as much as about your browsing habits as accessing the site without SSL.
In terms of downside, SSL adds latency (ignore CPU time for now, it adds a further 2+ RTT times for the CLIENT_HELLO and SERVER_HELLO + cipher negotiation/key exchange on connection. Breaks (until SNI becomes about) HTTP Host based virtual servers. Breaks any web-caching by a proxy, and in many cases by the browser (most browsers don't use their disk cache for SSL content).
All that downside, for what upside? Yes - for the few forms where someone submits passwords or other private data, yes. But why on earth would you want to use SSL otherwise?
Re: Ask HN: Why don't we see more HTTPS? Is CPU an issue?
#14Can somebody lend some insight into how SSL certs function for international users? I've had no problems with the inexpensive SSL certificates with domestic (US) users, but I've had complaints of users accessing things from other countries. Do SSL certs not function the same globally? Is it common for the CA's to not be globally accepted?
Re: Ask HN: Why don't we see more HTTPS? Is CPU an issue?
#15For HTTPS you need a dedicated IP since security negotiation happens before the HTTP hosts header is posted and your cert needs to cover the host you want to connect to. That is, it is impossible to host several sites using HTTPS on one single IP. HTTPS using SSL (instead of for instance TLS) means that this is a limitation built into HTTPS itself and can't be mitigated. With the current shortage on IPv4 IPs and most…
If you're like most newer startups that have their customers under a TLD (foo.mycorp.com, bar.mycorp.com), you can use wildcard SSL to manage the problem. Otherwise, yeah, you're looking at one IP per TLD.
Am I correct in thinking that a wildcard only gets you one level deep? e.g. that *.mycorp.com matches "foo.mycorp.com" but not "foo.bar.mycorp.com"?
Re: Ask HN: Why don't we see more HTTPS? Is CPU an issue?
#16Companies would rather not spend the money. It's as simple as that. Also, you might be interested in: http://bench.cr.yp.to/index.html
Single-domain certificates are cheap. RapidSSL charges $79/year, and you can do better. Wildcard certificates have come down as low as $200 a year, very recently. The price issue is mostly perception at this point, but like they say, perception is reality. I would gamble that most people don't realize how much cheaper SSL certification has become.
They came down, but now there are EV SSL certs that are still a couple hundred dollars/yr for a non-wildcard cert.
As a business owner, I feel a bit like it's a big con game, as I have trouble understanding what it is that EV SSL certs solve that wasn't supposed to be solved with the original SSL certs. It could just be my ignorance, but I still find $400/yr to file some papers and then do some math a bit absurd.
Re: Ask HN: Why don't we see more HTTPS? Is CPU an issue?
#17I don't support more HTTPS because of the cost of static IPs on EC2 (i.e. ~72/mo)
Huh? There is no cost for an elastic IP address when it is in use.
But there is a cost for running a separate instance for every IP since Amazon won't let you assign more than one address per instance.
Re: Ask HN: Why don't we see more HTTPS? Is CPU an issue?
#18Why though - would anyone want to browser a site like news.ycombinator.com over SSL? The vast majority of web data is public data so encryption is of little value, and due to the way SSL works, then there's arguably little value in SSL for authentication (if someone can hack the site, they can generally apply/install for a new SSL cert easily enough). In terms of privacy, SSL gains little - given that SSL breaks Host…
There may be only a few forms that have passwords, but every request includes your session cookie. An eavesdropper could hijack your session.
If I want to browse with TOR, it's pretty likely the exit nodes are sniffing my data. It kind of defeats the purpose of using TOR if I can't stay on HTTPS.
Re: Ask HN: Why don't we see more HTTPS? Is CPU an issue?
#19I don't worry about CPU. What I do worry about is cost and most of all the amount of effort required to set it up. You'd have to get a key somewhere (figure out where you get one that is both supported by most important browsers and as cheap as possible), install it (probably an afternoon's worth of work, mostly because of researching how) and then test it. Cost is important too. As a small start-up we adhere to the…
Nitpicky: You don't get a key somewhere. You make your own keypair, and send the public key off to be signed. It costs ~$100/year + you need an IP address, compare that to what I pay for shared hosting ($75/year including domain) and you get your answer.
> Nitpicky: You don't get a key somewhere. You make your own keypair, and send the public key off to be signed.
Precisely the type of details you'd had to figure out. For my current (very rudimentary) understanding of SSL that doesn't matter. Setting it up myself would mean I would have to know such things and more.
As for costs: We have several IPs and our hosting costs are about 70 euros/month/server. Still, I wouldn't shell out the 100 bucks per year simply because it's lost money. It doesn't solve any of my problems and my users don't care, or at least seem to not care.
I believe that to be the main reason. Users don't care. Tech people care, sometimes. Sometimes a site owner cares (banks etc.), but most of the time no one really cares too much about it. And when you think about it, if nobody cares, is it really a problem?
Re: Ask HN: Why don't we see more HTTPS? Is CPU an issue?
#20Companies would rather not spend the money. It's as simple as that. Also, you might be interested in: http://bench.cr.yp.to/index.html
Single-domain certificates are cheap. RapidSSL charges $79/year, and you can do better. Wildcard certificates have come down as low as $200 a year, very recently. The price issue is mostly perception at this point, but like they say, perception is reality. I would gamble that most people don't realize how much cheaper SSL certification has become.
It's not the cost of the certificate that's the issue. It's the SSL bandwidth overhead.