Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I am starting to see a majority of websites starting to use SSL as a standard practice for viewing the website securely now thanks to the revelations of Edward Snowden about the NSA surveillance that is happening.

Should we make it a web standard to make all websites to use SSL for security, viewing, payments, and everywhere?

I own a simple personal blog, and I have people say I need to use it because of me voicing my opinion, concerns, and ideas regarding the subject of the NSA, and they say they are starting to feel less secure without HTTPS...

share|improve this question
1  
Consider offering TLS just for increasing the amount of encrypted traffic on the web making it harder for malicious people to tell conspirative and boring traffic apart. –  Max Ried Mar 24 at 8:37

5 Answers 5

up vote 6 down vote accepted

Interesting question. However, the obvious answer would be if I can get a website with a browser, then the NSA can get it too. I am not trying to be a smarty-pants on this. SSL should be used for account login, payments, etc. As a normal course of work, it is not necessary.

Having said that, I do support SSL more than this answer implies. If you are a blogger, then I would not use SSL. If you are saying things you want private even under certain circumstances, then you should not post it or put it behind a login to better control who sees it.

Remember that the web is an open communications vehicle. It is design and geared toward this. Private communications vehicles are not promiscuous with who it connects to and shares information with and often deploys numerous security schemes to ensure secure communications. The web is designed to connect easily and anonymously with any client and share all or nearly all of the information that it has. Yes there are options for securing web communications to a point, however, it will be always be limited due to the nature of what it is.

share|improve this answer
    
You do have a point. The SSL Certificate keeps them from snooping and putting people on a "list" for being a visitor because I am telling the truth and analyzing their actions and bashing them to hell and back for it... –  user37204 Mar 24 at 5:44
    
Okay. I will let you in on a secret. I am a semi-retired consultant for the major telecoms. There was no encrypted packet we could not decrypt. It required special equipment, but it was equipment easily obtained. Our sniffers rarely had trouble with encryption including double-encrypted communications. It may be harder these days admittedly. As well, I am prior Naval Intel with DoD work. I am sure that if the NSA wants to look at your encrypted communications, they can. Now I will tell you that generally, they do not care about what you are saying as long as you are not talking to a terrorist. –  closetnoc Mar 24 at 5:51
    
It occurred to me that I should say that I do not like what the NSA is doing nor do I think it is right. It is not. I do also want to point out the traffic load is such that they cannot look at everything nor would they try. What is likely most important to them first is the packet header information to establish suspicious point to point communications before examining any packet. Therefore, anyone going to your blog is not likely going to be sniffed unless it is Osama reincarnated or maybe his cousin. (humor) –  closetnoc Mar 24 at 5:59
    
Then SLL is compromised by you and anyone with your skills, that is how I am taking this... Plus the Revelations by Edward Snowden and what was released doesn't mean they recording everything about us, when it says they are? Or reading these leaks for myself of what the NSA has done and is doing is not accurate? –  user37204 Mar 24 at 6:01
    
Sorry for the last few questions. There is just a lot that is not making sense with all of this stuff which is happening. –  user37204 Mar 24 at 6:02

Secrecy

Since your content is public, HTTPS obviously won't hide it, but it might provide some benefits depending on the nature of your site.

Privacy

When someone requests a page over HTTPS, the request is encrypted, so if someone is watching your visitors, they won't know which pages they requested. Unfortunately, DNS (the system for getting an IP address based on your website's domain name) isn't encrypted, so an observer could still identify who visits your website. Even if that was encrypted, in most cases you could still tell which website someone is visiting based on IP addresses, which can't be hidden in the internet's current design.

Wikipedia offers HTTPS, which you might think is pointless because the content is public, but by doing this they protect their users: If someone is looking up "unpatriotic" things on Wikipedia (using HTTPS), their government can't tell which pages they're reading, just that they're on Wikipedia. Twitter is another case the content itself is public, but people don't necessarily want other people to know what they're doing on it.

Password Security

The other major reason you might want to consider HTTPS is if you have any login pages or other places where you accept private data from users (including yourself). If you don't support HTTPS at all, passwords and other information will be sent "in the clear", and anyone who can read network data can see them (the scary case used to be other people on the same wifi network as you; now it also includes various government agencies looking for blackmail material).

If you just support HTTPS on the login page, but not anywhere else, a clever attacker will intercept every page except the login page, and change the "Login" link to not use HTTPS, then intercept your communication (and if you force that page to HTTPS, they can just intercept the traffic and provide a fake version of it that does work). You can prevent this by always checking for a lock icon in your URL bar before logging in, but almost no one remembers to do that every time.

share|improve this answer

I largely agree with Closetnoc's points, but there's another point that's been overlooked: Tor users need a SSL version to prevent exit nodes from eavesdropping.

If you suspect any of your readers use Tor, you should have SSL enabled as a matter of practise.

Also, +1 on Max Reid's point: at the very least, you help normalise the use of encryption for non-critical traffic, thus increasing the effort intelligence agencies need to exert in order to identify desirable packets.

share|improve this answer
    
I do like the idea of making the NSA's life harder. Unfortunately, it may make life harder for all-round. More CPU cycles, larger data transfers, more packets, slower transfer rates, etc. Of course this is just a tiny drip per site, but enough sites and you just may have a real problem let alone what the NSA is doing. Hold on. The NSA will have a knot jerked into it's tail as soon as 2016 approaches. Right now it is just a small fire under their a$$. –  closetnoc Mar 24 at 15:32
4  
@closetnoc TLS increases transfer size, what, like, 1%? And any semi-modern CPU can handle all the crypto a web browser can think to throw at it. What's the problem? –  Matt Nordhoff Mar 24 at 15:50
    
I agree. I called it a tiny drip. Perhaps it is more like a super tiny drip. But I suspect that enough super tiny drips will really effect life down the line. Think about the scope of the web and if everybody migrated to SSL, that would add up kinda fast. It may not take down the net, but the effect would be felt I am sure. –  closetnoc Mar 24 at 15:55
1  
@closetnoc 1% of a big thing is still 1%. –  Matt Nordhoff Mar 24 at 16:22
    
The math unfortunately does not work that way. Assume a telco has a finite capacity. All of a sudden, all in one day, every site on the web starts using SSL. That is 1% times how many? The telco's finite capacity may be breached depending on what it is. Certainly, it would have to be adjusted and cost more. Besides, I would rather people put in NSA keywords on their sites and in their e-mails. Perhaps a website with a web bug that does this for me. That way, each site can be updated in a flash and the NSA has a moving target that hopefully could be smarter than they are. Now that would be fun! –  closetnoc Mar 24 at 16:31

There isn't really a reason not to, other than the cost of the SSL itself.

For a typical webserver deployment SSL adds little overhead.

There are talks for the http 2.0 standard to make encryption mandatory: http://beta.slashdot.org/story/194289

share|improve this answer

HTTPS can achieve two things:

  • Authentication. Making sure that you are communicating with the real domain owner.
  • Encryption. Making sure that only this domain owner and you can read the communication.

Probably everyone agrees that HTTPS should be mandatory when transmitting secrets (like passwords, banking data etc.).

But there are several other cases where and why the use of HTTPS can be beneficial:

Attackers can’t tamper with requested content.

When using HTTP, eavesdroppers could manipulate the content your visitors see on your website. For example:

  • Including malware in the software you offer for download.
  • Censoring some of your content. Changing your expressions of opinion.
  • Injecting advertisements.
  • Replacing the data of your donations account with their own.

Of course this also applies to content sent by your users, for example wiki edits. However, if your users are anonymous, the attacker could "simulate" being a user anyway (unless the attacker is a bot and there is some effective CAPTCHA barrier).

Attackers can’t read requested content.

When using HTTP, eavesdroppers could know which pages/content on your host your visitors access. Although the content itself may be public, the knowledge that a specific person consumes it is problematic:

  • It opens an attack vector for social engineering.
  • It infringes privacy.
  • It can lead to surveillance and punishment (right up to imprisonment, torture, death).

Of course this also applies to content sent by your users, for example mails via a contact form.


All that said, simply offering HTTPS in addition to HTTP would only protect users that check (or locally enforce, e.g. with HSTS) that they are using it. Attackers could force all other visitors to use the (vulnerable) HTTP variant.

So if you come to the conclusion that you want to offer HTTPS, you might want to consider enforcing it (server-side redirect from HTTP to HTTPS, send HSTS header).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.