Using HTTPS on the entire sites 2011 and beyond

Question

I know this has been asked before, but I am curious what all of you guys think, with the advent of programs like firesheep, released only 6 months ago. Is it a good idea to use https on an entire site? I am aware that is has speed issues, browser warning popups and the like, but how likely and serious it could get if you don't have it for every page? A friend told me it is useless if even just one part of the site where a user is logged in is not https, because people can intercept the cookies, and therefore pretend to be you and use your account as they please, including accessing the https parts.

1. Do you think this is where the future of the internet is going towards, and is it wise to implement it now?

2. The site has log in, credit card/ecommerce type pages as well as other pages that only has normal blog entry type posts. Is it still fairly alright to just use https on the log in and payments part of the site, or will it really compromise security?

3. What is the reason why sites like ebay and amazon until now, only chose to do it on certain parts of the site? Does that mean they are now easily hackable?

4. How much slower will using https on everything be... are there any other cons apart from the ones mentioned above?

5. Are the browser pop-up issues solvable?

Answer 1

Your friend is right. Cookies are sent with every request, even for things like images, so you have to make sure everything is being sent securely if the cookies are sensitive.

The browser warnings only occur when there's a problem with the server's certificate. The most common problems are an expired certificate, an improperly configured certificate (i.e. trying to use the same non-wildcard certificate for multiple domains), or a certificate that hasn't been issued by a trusted certificate authority (Comodo, Thawte, Geotrust, etc).

When HTTPS is used, there is an overhead. There's a "handshake" that occurs at the beginning of a connection that takes a fraction of a second, and there is slightly more processor load. This used to be an issue when folks were on dial up connections and CPUs were slow. Now, this isn't a determining factor, and you shouldn't see more than a few percent increase in CPU load. Processor time is cheap now. These performance issues are negligible.

I don't know whether the internet is going all-encrypted. Perhaps. You only need to provide encryption when personal details, including cookies that will log a user in automatically (they're the equivalent of a username/password, albeit somewhat more ephemeral). If the cookies aren't sensitive, and no private details are being transmitted over the wire, encryption isn't mandatory.

I doubt eBay, Amazon, et al are vulnerable to session hijacking. You'll also note that these sites will prevent users from doing special things like updating their passwords, making payments, etc without the user providing their a password again. Session hijacking is only a problem if a malicious user can do something bad, otherwise, a session cookie is worthless.

SSL should be used for anything sensitive. If it's sensitive, encrypt. If it's not, cleartext is okay. Encryption isn't a panacea, but a piece in your security strategy.

Answer 2

Keeping the session cookie secure is surely one of the biggest problems, if a site switches between secure and non secure pages. But that's only a problem, because most sites combine session handling and authentication. If you use the session cookie exclusively for maintaining the session, you can avoid this security risk:

Switching-between-http-and-https-pages

Although this solves the problem with the session cookie, the question remains, is the additional complexity worth the saving of processor power for a full HTTPS site? Unfortunately it's difficult to get useful field reports or benchmarks of real scenarios. Big companies like Google were switching to full encryption, though it seems that they did a lot of optimizations before:

Overclocking-ssl

My personal opinion is, that for sites with low until moderate traffic you should avoid complexity and use HTTPS for all pages. If you have (or expect) a lot of traffic you can consider switching between HTTP and HTTPS.