Nice. Remember the days when IT professionals would exclaim that this was a bad idea?
Seems like it's cyclical thing. DNS over HTTPS is now the big bad technology.
Encrypted web traffic now exceeds 90%
11–20 of 311 posts
Re: Encrypted web traffic now exceeds 90%
#12I wonder how many fuel is burned to power servers and browsers to constantly encrypt and decrypt data which could be transferred much more efficiently unencrypted.
By encrypting all traffic, you protect sensitive traffic better because an adversary can't tell sensitive from non-sensitive communications.
Re: Encrypted web traffic now exceeds 90%
#13I wonder how many fuel is burned to power servers and browsers to constantly encrypt and decrypt data which could be transferred much more efficiently unencrypted.
I wonder how much metal is spent making door locks. Eh, probably better leaving all doors unlocked.
I wonder how much steel is in a banks safe. Eh, better leave the safe open.
I wonder how much time people spend typing in their passwords. Eh, better remove passwords from all sites.
Re: Encrypted web traffic now exceeds 90%
#14Nice. Remember the days when IT professionals would exclaim that this was a bad idea? Seems like it's cyclical thing. DNS over HTTPS is now the big bad technology.
No, haha. When was that a thing?
Re: Encrypted web traffic now exceeds 90%
#15I wonder how many fuel is burned to power servers and browsers to constantly encrypt and decrypt data which could be transferred much more efficiently unencrypted.
I wonder how much metal is spent making door locks. Eh, probably better leaving all doors unlocked. I wonder how much steel is in a banks safe. Eh, better leave the safe open. I wonder how much time people spend typing in their passwords. Eh, better remove passwords from all sites.
I agree it's absurd to use this as an argument against encryption, but I am curious about what the number is. How much could a banana cost Michael, $10?
Re: Encrypted web traffic now exceeds 90%
#16Earlier quoted context omitted.
Pretty much this. I ran into a local store taking credit cards awhile back, no TLS, weird, so I go to the store owner in person. I explain the problem and he insists that can't be the case, he's mad at me. "See! It's got a lock on the website!"... on the homepage. I direct him to the store and now it says Not Secure. That did more to explain the situation than my attempt at TLS and HTTPS and Certs. He was able to cal…
If that doesn't work, there's also the argument that "credit card providers require it, and could stop you from taking credit cards until you fix it".
You're right, but didn't have to. This guy when he could get past being mad at me knew that was against the rules. Also even if it was allowed, no one wants to shop at a place that says Not Secure.
Side topic, but I've been trying to explain to our terrible CFO for years that PCI / PCI DSS is a real thing. He thinks that's the type of regulation that only giant companies have to deal with.
Re: Encrypted web traffic now exceeds 90%
#17I wonder how many fuel is burned to power servers and browsers to constantly encrypt and decrypt data which could be transferred much more efficiently unencrypted.
Efficiency is overrated. Encryption stops injection or modification of data in flight in its tracks, that alone makes it worth it. Otherwise, how would you know you receive what the sender sent you?
Re: Encrypted web traffic now exceeds 90%
#18I wonder how many fuel is burned to power servers and browsers to constantly encrypt and decrypt data which could be transferred much more efficiently unencrypted.
I bet if you stress test a server via http and via https, the CPU time won't be as different as you might think.
The main efficiency lost is that you can no longer have big shared cache networks for everybody, but those were a security risk anyway.
Re: Encrypted web traffic now exceeds 90%
#19Thanks NSA
Re: Encrypted web traffic now exceeds 90%
#20Awesome! Any idea how much of that is attributable to LetsEncrypt and HTTPSEverywhere?
Is a LetsEncrypt certificate "just as secure" as other certs? I have to imagine the answer is "no" simply because LetsEncrypt is free and the other certs aren't -- what more do you get by paying for a cert?