Why isn't HTTPS everywhere yet?
webappsec-test.info
Why isn't HTTPS everywhere yet?
1–10 of 130 posts
Re: Why isn't HTTPS everywhere yet?
#2Another big blocker is cost.
For example, one of the biggest CDNs in the world (I'm looking at you, Akamai), charge dramatically more for delivering content over HTTPS. Let's say you're delivering video content at scale, the difference between HTTP and HTTPS delivery can be many millions of dollars a year.
But why not use a different CDN, say Cloudfront which prices the same for HTTP and HTTPS?, well, simple, the same problem. Cloudfront is many times more expensive than other CDNs at scale.
Really, we need to apply pressure to all CDNs to equal out their HTTPS pricing (Its not just Akamai...)
Re: Why isn't HTTPS everywhere yet?
#3Another big blocker is cost. For example, one of the biggest CDNs in the world (I'm looking at you, Akamai), charge dramatically more for delivering content over HTTPS. Let's say you're delivering video content at scale, the difference between HTTP and HTTPS delivery can be many millions of dollars a year. But why not use a different CDN, say Cloudfront which prices the same for HTTP and HTTPS?, well, simple, the sam…
I'd imagine HTTPS is significantly more expensive to host than plain HTTP, due to the CPU requirements of the crypto involved.
Re: Why isn't HTTPS everywhere yet?
#4I like the irony of that page being served over plain HTTP :-)
Re: Why isn't HTTPS everywhere yet?
#5I like the irony of that page being served over plain HTTP :-)
Ha! And HTTPS doesn't seem to work for me at all.
Re: Why isn't HTTPS everywhere yet?
#6a2enmod headers
echo -e "ServerSignature Off\nServerTokens Prod" >> /etc/apache2/apache2.conf
/etc/init.d/apache2 restart
openssl req -new -nodes -keyout webappsec-test.info.key -out webappsec-test.info.csr -newkey rsa:2048
cat webappsec-test.info.csr
Register here:
Copy and paste csr...
cat Domain_cert.pem CA_root.pem
https://mozilla.github.io/server-side-tls/ssl-config-generat...
====>
A+ on
Now? What's so hard about that?
I guess if you're using EC2 and Ubuntu on your server... ehhh...
Re: Why isn't HTTPS everywhere yet?
#7Another big blocker is cost. For example, one of the biggest CDNs in the world (I'm looking at you, Akamai), charge dramatically more for delivering content over HTTPS. Let's say you're delivering video content at scale, the difference between HTTP and HTTPS delivery can be many millions of dollars a year. But why not use a different CDN, say Cloudfront which prices the same for HTTP and HTTPS?, well, simple, the sam…
I'd imagine HTTPS is significantly more expensive to host than plain HTTP, due to the CPU requirements of the crypto involved.
Maybe at the CDN level where there's lots of caching it's different, but for regular hosting apps are primarily IO bound so it's essentially "free" to do encryption. From http://www.imperialviolet.org/2010/06/25/overclocking-ssl.ht...:
> In January this year (2010), Gmail switched to using HTTPS for everything by default. Previously it had been introduced as an option, but now all of our users use HTTPS to secure their email between their browsers and Google, all the time. In order to do this we had to deploy no additional machines and no special hardware. On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10KB of memory per connection and less than 2% of network overhead. Many people believe that SSL takes a lot of CPU time and we hope the above numbers (public for the first time) will help to dispel that.
Re: Why isn't HTTPS everywhere yet?
#8Another big blocker is cost. For example, one of the biggest CDNs in the world (I'm looking at you, Akamai), charge dramatically more for delivering content over HTTPS. Let's say you're delivering video content at scale, the difference between HTTP and HTTPS delivery can be many millions of dollars a year. But why not use a different CDN, say Cloudfront which prices the same for HTTP and HTTPS?, well, simple, the sam…
I'd imagine HTTPS is significantly more expensive to host than plain HTTP, due to the CPU requirements of the crypto involved.
[deleted]
Re: Why isn't HTTPS everywhere yet?
#9a2enmod headers echo -e "ServerSignature Off\nServerTokens Prod" >> /etc/apache2/apache2.conf /etc/init.d/apache2 restart openssl req -new -nodes -keyout webappsec-test.info.key -out webappsec-test.info.csr -newkey rsa:2048 cat webappsec-test.info.csr Register here: https://www.startssl.com/ Copy and paste csr... cat Domain_cert.pem CA_root.pem https://mozilla.github.io/server-side-tls/ssl-config-generat... ====> A+…
Why use StartSSL, when Let's Encrypt will give you an equally good certificate (with more flexibility on SANs!) with less hassle?
Re: Why isn't HTTPS everywhere yet?
#10Another big blocker is cost. For example, one of the biggest CDNs in the world (I'm looking at you, Akamai), charge dramatically more for delivering content over HTTPS. Let's say you're delivering video content at scale, the difference between HTTP and HTTPS delivery can be many millions of dollars a year. But why not use a different CDN, say Cloudfront which prices the same for HTTP and HTTPS?, well, simple, the sam…
I'd imagine HTTPS is significantly more expensive to host than plain HTTP, due to the CPU requirements of the crypto involved.
Nope. The symmetric crypto is basically free. The asymmetric crypto is cheap.
IPv4 addresses cost. Most big sites can't quite go SNI-only yet. Soon!
Customer support costs. Why would TLS involve more customer support? Because it's a technology designed only to break connections. Ideally that's only the adversarial connections---but much like the TSA, a mis-designed authentication scheme can cause great stress and drama.
I do think the world will be all-TLS before too long; the parts that aren't will probably not be HTTP over TCP (e.g., content addressable networking).