Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Encrypted web traffic now exceeds 90%

netmarketshare.com

Post reply on HN
Print view View original

21–30 of 311 posts

Re: Encrypted web traffic now exceeds 90%

#21

Post by smhenderson »

aesh2Xa1 wrote: post #14
Jonnax wrote: post #11

Nice. Remember the days when IT professionals would exclaim that this was a bad idea? Seems like it's cyclical thing. DNS over HTTPS is now the big bad technology.

No, haha. When was that a thing?

I can't find anything specific at the moment but anecdotally I remember seeing this and being told it hurt performance to encrypt everything. The "solution" was to only encrypt sensitive pages like forms for credit cards.

I'm sure there was some substance to it at the time when computers, networks and browsers were slower but I also completely ignored that advice at the time and always used SSL everywhere on sites I set up.

I've never manged a very high traffic site so any extra overhead from SSL was negligible for us.

Re: Encrypted web traffic now exceeds 90%

#22

Post by overcast »

Jonnax wrote: post #11

Nice. Remember the days when IT professionals would exclaim that this was a bad idea? Seems like it's cyclical thing. DNS over HTTPS is now the big bad technology.

They never said it was a bad idea, the concerns were that at the time it took too much processing power to scale.

Re: Encrypted web traffic now exceeds 90%

#23

Post by mdavidn »

aesh2Xa1 wrote: post #14
Jonnax wrote: post #11

Nice. Remember the days when IT professionals would exclaim that this was a bad idea? Seems like it's cyclical thing. DNS over HTTPS is now the big bad technology.

No, haha. When was that a thing?

When people were concerned about HTTPS overhead? Both in terms of increased latency when establishing a connection and AES overhead for the duration of the connection. Hardware TLS accelerators used to be a thing.

Re: Encrypted web traffic now exceeds 90%

#24

Post by kstrauser »

vbezhenar wrote: post #10

I wonder how many fuel is burned to power servers and browsers to constantly encrypt and decrypt data which could be transferred much more efficiently unencrypted.

On a modern CPU with encryption instructions in the ISA, a vanishingly small amount of power compare to the databases and JavaScript involved in the requests.

Re: Encrypted web traffic now exceeds 90%

#25

Post by jchw »

aesh2Xa1 wrote: post #14
Jonnax wrote: post #11

Nice. Remember the days when IT professionals would exclaim that this was a bad idea? Seems like it's cyclical thing. DNS over HTTPS is now the big bad technology.

No, haha. When was that a thing?

In the early 2000s almost any traffic that wasn’t involving financial services or ecommerce was plain HTTP. Gradually, HTTPS became optional (remember encrypted.google.com?) and more sites used it for login (but not all pages, even with cookies.)

This meant that MITMs were a lot more effective. Hell, even today Comcast and some other ISPs will MITM you to send notifications when it can do so on a plaintext HTTP connection.

A lot of IT departments also used this to be able to block unwanted traffic and perform monitoring. Now a lot of that relies on DPI techniques like analyzing SNI, or intercepting DNS. DoH and encrypted SNI work together to close both gaps, and widespread deployment of them would largely kill the ability to MITM or monitor consumer devices without modifications.

In modern times the cost of TLS certificates and the overhead of TLS encryption has dropped to effectively zero, so that ship has sailed, and nobody even remembers there was any concern to begin with. Maybe this time, it will be different, due to the lack of other options for MITM.

I imagine in the future there will be similar concerns about protocols that encrypt session layer bits like CurveCP.

Re: Encrypted web traffic now exceeds 90%

#26

Post by K0SM0S »

vbezhenar wrote: post #10

I wonder how many fuel is burned to power servers and browsers to constantly encrypt and decrypt data which could be transferred much more efficiently unencrypted.

Typically very little. Most current CPUs integrate some variation of the Advanced Encryption Standard instruction set (AES, AES-NI, etc), so just like H.264 or H.265 decoding, it can be very, very efficient with custom instructions (magnitudes of order faster / less power consuming than without).

This is why most devices are equally capable of rendering http or https (you never have to 'revert' to http because a website is too slow in https... it's just not a thing). A stupid background app may consume 10x or 100x your encryption budget.

Re: Encrypted web traffic now exceeds 90%

#27

Post by a13n »

mikece wrote: post #20
chrisweekly wrote: post #2

Awesome! Any idea how much of that is attributable to LetsEncrypt and HTTPSEverywhere?

Is a LetsEncrypt certificate "just as secure" as other certs? I have to imagine the answer is "no" simply because LetsEncrypt is free and the other certs aren't -- what more do you get by paying for a cert?

It is just as secure, you get nothing more by paying.

Re: Encrypted web traffic now exceeds 90%

#28

Post by tomschlick »

mikece wrote: post #20
chrisweekly wrote: post #2

Awesome! Any idea how much of that is attributable to LetsEncrypt and HTTPSEverywhere?

Is a LetsEncrypt certificate "just as secure" as other certs? I have to imagine the answer is "no" simply because LetsEncrypt is free and the other certs aren't -- what more do you get by paying for a cert?

They are just as secure. Here is an article explaining it deeper: https://www.troyhunt.com/on-the-perceived-value-ev-certs-cas...

Re: Encrypted web traffic now exceeds 90%

#30

Post by roywiggins »

mikece wrote: post #20
chrisweekly wrote: post #2

Awesome! Any idea how much of that is attributable to LetsEncrypt and HTTPSEverywhere?

Is a LetsEncrypt certificate "just as secure" as other certs? I have to imagine the answer is "no" simply because LetsEncrypt is free and the other certs aren't -- what more do you get by paying for a cert?

It used to be you paid because everyone who was trusted by browser manufacturers charged a fee, not because signing a certificate is actually hard or could be done in a "non secure" way. A signature is a signature.

LetsEncrypt signatures are now trusted by the browsers, so there's usually no need to pay for the service.

Post reply on HN