New answers tagged

1

You have two options to secure your main domain (mysite.com) and its sub-domains (play.mysite.com and test.mysite.com). SSL is not only for ecommerce, payment merchant sites where financial transactions or login credentials are shared over the website. It is as equally important for content-based website. Attackers always search for plain HTTP website or ...


0

And, just to add one more thing to all answers, I'll just talk about latency. Because, it seems that no one wrote here about this. Having a low client-to-server HTTP latency is critical for making fast-loading, responsive websites. TCP/IP alone has 3-way handshake (initial connection setup for plain HTTP over TCP requires 3 packets). When SSL/TLS is used, ...


1

In addition to the other answers, browsers should (as in RFC 2119) send the User-Agent header. It provides enough information about what platform a user is using if he sends the actual User-Agent. If Eve can eavesdrop on a request made by Alice, and Alice sends the actual User-Agent, Eve will know what platform Alice uses without Alice making a connection to ...


1

The simple answer is that there's no good reason not to. In the past there were arguments about only using SSL where absolutely necessary (e.g. on ecommerce sites collecting payment details). These were largely to do with the installation procedure for SSL certificates, cost, additional load on the webserver, and network limitations - at a time when people ...


9

You get HTTP/2 support, the new web standard designed to significantly improve website loading speeds. Because browser makers have chosen to support HTTP/2 only over HTTPS, enabling HTTPS (on a server that supports HTTP/2) is the only way to get this speed upgrade.


10

(Parts taken from my answer to a similar question.) HTTPS can achieve two things: Authentication. Making sure that the visitor is communicating with the real domain owner. Encryption. Making sure that only this domain owner and the visitor can read their communication. Probably everyone agrees that HTTPS should be mandatory when transmitting secrets (...


1

Besides the benefits mentioned by others there is one reason that will make you switch to SSL unless you don't care about your visitors that use Chrome - the new versions of Chrome (starting from the end of the year as far as I remember) are going to show a warning (which will drive away users from your site) by default for all sites that aren't using HTTPS. ...


3

Marketing firms like Hitwise pay ISPs to gather data about your site when you don't use SSL. Data about your site gets collected which you might rather not have your competitors know: user demographics visitor statistics popular pages search engine keywords (although with "not provided" this is less of an issue these days)


70

HTTPS does not just provide secrecy (of which you are doubting the value, though there are good reasons for it still) but also authenticity, which is always of value. Without it, a malicious access point/router/ISP/etc. can rewrite any part of your site before displaying it to the user. This could include: injecting ads for your competitors injecting ads ...


6

It prevents man in the middle attacks that make you think you are visiting your site but present a page that is actually from another and may attempt to get info from you. Since the data is encrypted, it also makes it more difficult for an attacker to manipulate the page as you see it. Because you need a SSL certificate, that verifies you are the owner of ...


20

"nothing secret on the site" ...According to you. There migh be a perfectly fine reason someone wants a secure connection. It (partly) creates privacy: My admin can see that I'm browsing some picture site on my phone via url, but he can't tell if I'm watching pics of cute cats or hardcore porn. I'd say that's pretty damn good privacy. "a content" and "...



Top 50 recent answers are included