55

Let's say I have a large content-only site; no login or logout, no usernames, no email addresses, no secure area, nothing secret on the site, nada. People just come to the site and go from page to page and look at content.

Besides a slight bump in SEO from Google (very slight, from what I've read), is there any benefit of forcing the site to load via HTTPS?

  • 1
    I don't believe this is a duplicate of Force Using SSL on Site now?. Although some answers may end up being similar, that question is asking for advice about whether or not to use SSL while this question is not. If anything, the other question should be closed for being opinion based. – Stephen Ostermiller Jul 8 '16 at 16:10
  • 4
    Let's flip this around: what is the benefit of NOT using SSL? There isn't any that I know of. Oh sure, the implementation which would be a one off and take (comparatively to everything else) no time. So, if one approach has no downsides and some upsides, the other has no upsides and (according to you) no downsides, then...why stick with the latter? – VLAZ Jul 9 '16 at 9:27
  • 3
    @Vld - performance. These days, we often try to optimize site initial load times to sub-second performance figures, with a goal of 1/2 second. On a slightly slow internet connection (packet latency around 100ms) the SSL handshake can easily take 300ms, which might well push you over a performance goal. For mobile users its worse: mobile networks have longer packet latencies and processing time for the certification verification could easily be another few hundred ms on a slower phone. – Jules Jul 9 '16 at 10:00
  • 6
    Mobile carriers always tamper with unencrypted HTTP traffic, whether it's for image (over)compression, injecting evil Javascript or more agressive cache-control headers. HTTPS will prevent all that nonsense. – André Borie Jul 9 '16 at 11:05
  • 2
    @Josef Not true. HTTP/2 works over unencrypted connections just as well. No browser can do that, but that's browser limitation, not HTTP/2. Saying that "HTTP/2 only works over TLS" is like saying that "technology X doesn't work because Internet Explorer don't implement it". Look where it took us. – Agent_L Jul 11 '16 at 15:06

12 Answers 12

84

HTTPS does not just provide secrecy (of which you are doubting the value, though there are good reasons for it still) but also authenticity, which is always of value. Without it, a malicious access point/router/ISP/etc. can rewrite any part of your site before displaying it to the user. This could include:

  • injecting ads for your competitors
  • injecting ads or annoying widgets that make your site look bad and harm your reputation
  • injecting exploits to perform drive-by downloads of malware onto the visitor's computer, who then (rightly!) blames you for it happening
  • replacing software downloads from your site with ones that have bundled malware
  • lowering the quality of your images
  • removing parts of your site they don't want you to see, e.g. things that compete with their own services or depict them in a bad light
  • etc.

Failure to protect your users from these things is irresponsible.

  • 27
    @Mike Not really. There's plenty of off-the-shelf software to do this, and it all handles decompression and recompression just fine. – ceejayoz Jul 8 '16 at 23:55
  • 3
    @Mike Not really. A full rewriting proxy can decode all the traffic and inject whatever new stuff it wants afresh. – Nayuki Jul 10 '16 at 2:10
  • 10
    FYI most if not all of my examples have actually been seen in the wild. – R.. Jul 10 '16 at 2:27
  • 2
    @DavidMulder your first comment said "decentralization [...] not a good thing" – jiggunjer Jul 12 '16 at 2:22
  • 3
    Can we please not turn the comments on this answer into an off-topic bikeshed-esque rant on unrelated issues? – R.. Jul 12 '16 at 13:56
25

"nothing secret on the site"

...According to you. There migh be a perfectly fine reason someone wants a secure connection. It (partly) creates privacy:

My admin can see that I'm browsing some picture site on my phone via url, but he can't tell if I'm watching pics of cute cats or hardcore porn. I'd say that's pretty damn good privacy. "a content" and "the content" can make all the difference in the world.Agent_L

You might think it's insignificant, or maybe it's not a big deal now but could be at another point in time. I am a firm believer that no-one apart from me and the website should know exactly what I'm doing.

It creates trust. Having the padlock is a sign of security and it can signify some degree of skill regarding the website, and thus your products.

It makes you less of a target for e.g. MitM attacks. Security increases.

With initiatives like Let's Encrypt, which make it a lot easier and free, there aren't many downsides. CPU power taken up by SSL is negligible these days.

  • 11
    Unfortunately SSL does not stop corporate IT or your ISP or people on the public cafe wifi with you from knowing what sites you're visiting. The DNS lookups are still done in the clear. While they can't see the content, nor the exact URL, nor that you're even using a web browser, they can see that you're accessing penisland.com (which is, of course, a site for pen enthusiasts, but might be misconstrued). Using a VPN or SOCKS5 proxy will protect your DNS queries. – Schwern Jul 8 '16 at 16:40
  • 3
    @Martijn: With Server Name Indication (which all modern browsers support), the hostname of the website is itself sent in the clear as part of the HTTPS handshake. It's not just a matter of sidechannel attacks and cannot be mitigated with e.g. DNSsec. – Kevin Jul 8 '16 at 20:35
  • 3
    @Schwern I never understood the argument that HTTPS doesn't protect the host name because the DNS lookup and SNI and the server's certificate are in the clear. Of course that's true as stated, but plain text HTTP is by no means any better in this regard! – a CVn Jul 10 '16 at 12:47
  • 5
    @Schwern My admin can see that I'm browsing tumblr on my phone, but he can't tell if I'm watching pics of cute cats or hardcore porn. I'd say that's pretty damn good privacy. "a content" and "the content" can make all the difference in the world. – Agent_L Jul 11 '16 at 8:14
  • 2
    @Agent_L No, even that is not good advice. If you go to https://penisland.tumblr.com/ your browser will do a DNS request for penisland.tumblr.com which, unless you've protected your DNS queries, the network admin can see. Then your browser has to get the images, Javascript, CSS, and ads from various domains which generate more DNS requests. They could be from any domain. The few porn Tumblr domains I tried don't have anything obvious, Tumblr tends to host images and videos in house, but you cannot rely on that for privacy. – Schwern Jul 11 '16 at 16:27
12

You get HTTP/2 support, the new web standard designed to significantly improve website loading speeds.

Because browser makers have chosen to support HTTP/2 only over HTTPS, enabling HTTPS (on a server that supports HTTP/2) is the only way to get this speed upgrade.

  • This is pretty huge and needs to be hyped more. It makes a business case for loading HTTPS only that most managers can get behind. – Dewi Morgan Jul 12 '16 at 14:53
10

(Parts taken from my answer to a similar question.)


HTTPS can achieve two things:

  • Authentication. Making sure that the visitor is communicating with the real domain owner.
  • Encryption. Making sure that only this domain owner and the visitor can read their communication.

Probably everyone agrees that HTTPS should be mandatory when transmitting secrets (like passwords, banking data etc.), but even if your site does not process such secrets, there are several other cases where and why the use of HTTPS can be beneficial.

Attackers can’t tamper with requested content.

When using HTTP, eavesdroppers could manipulate the content your visitors see on your website. For example:

  • Including malware in the software you offer for download (or if you don’t offer any software downloads, the attackers start doing so).
  • Censoring some of your content. Changing your expressions of opinion.
  • Injecting advertisements.
  • Replacing the data of your donations account with their own.

HTTPS can prevent this.

Attackers can’t read requested content.

When using HTTP, eavesdroppers can learn which pages/content on your host your visitors access. Although the content itself may be public, the knowledge that a specific person consumes it can be problematic:

  • It opens an attack vector for social engineering.
  • It infringes privacy.
  • It can lead to surveillance and punishment (right up to imprisonment, torture, death).

This, of course, depends on the nature of your content, but what seems to be harmless content to you can be interpreted differently by other parties.

Better be safe than sorry. HTTPS can prevent this.

  • 1
    Indeed, HTTPS can prevent it. In some situations, it might not. See Lenovo Superfish for a fairly recent example. – a CVn Jul 8 '16 at 22:06
  • @MichaelKjörling: Yes, I’m aware of this (that’s why I made sure to use "can" ;)), but it’s an issue stemming from the behaviour of the visitor, not an issue with HTTPS itself or the way the webmaster uses it, right? The visitor should care about which CAs to trust (and the visitor should care about which software to install, especially if it has the permission to fiddle with the list of CAs to trust). – unor Jul 8 '16 at 22:25
  • Indeed; I'm not arguing against your point, only adding to it! – a CVn Jul 8 '16 at 22:33
6

It prevents man in the middle attacks that make you think you are visiting your site but present a page that is actually from another and may attempt to get info from you. Since the data is encrypted, it also makes it more difficult for an attacker to manipulate the page as you see it.

Because you need a SSL certificate, that verifies you are the owner of the site at a minimum giving at least some verification of who you are.

3

Marketing firms like Hitwise pay ISPs to gather data about your site when you don't use SSL. Data about your site gets collected which you might rather not have your competitors know:

  • user demographics
  • visitor statistics
  • popular pages
  • search engine keywords (although with "not provided" this is less of an issue these days)
3

And, just to add one more thing to all answers, I'll just talk about latency. Because, it seems that no one wrote here about this.

Having a low client-to-server HTTP latency is critical for making fast-loading, responsive websites.

TCP/IP alone has 3-way handshake (initial connection setup for plain HTTP over TCP requires 3 packets). When SSL/TLS is used, the connection setup is more involved, meaning the latency for new HTTPS connections is unavoidably higher than plaintext HTTP.

The problem with HTTP is that it is not safe. So if you have sensitive data, you need some form of security. When you type something into your web browser beginning with “https”, you are asking your browser to use an encryption layer to protect the traffic. This provides reasonable protection against eavesdroppers, but the problem is that it will be slower. Since we want to encrypt our traffic, there will be some computation involved, which adds to the time. This means that if you don’t design your system correctly, your website will appear sluggish to users.

To conclude:

I have a large content-only site; no login or logout, no usernames, no email addresses, no secure area, nothing secret on the site, nada. People just come to the site and go from page to page and look at content.

If this is the case, I won't use SSL at all. I would like to have my page when you click it that it opens in one second. That's from user experience. You do as you wish, I just don't put certificates on everything I make. In this particular case, I wouldn't use it at all.

  • IMO, this is just as much of a correct answer as the one getting all the votes. – Michael Yaeger Sep 26 '16 at 21:06
  • youtube.com/watch?v=e6DUrH56g14 mentions some techniques to mitigate the performance impact even if you (or a large share of your clients) can't do HTTP/2 for some reason. – a CVn Aug 24 '17 at 18:43
1

Besides the benefits mentioned by others there is one reason that will make you switch to SSL unless you don't care about your visitors that use Chrome - the new versions of Chrome (starting from the end of the year as far as I remember) are going to show a warning (which will drive away users from your site) by default for all sites that aren't using HTTPS.

//EDIT:

Here are links to two more detailed articles, though I can't seem to find the one I've read about when they're planning to officially introduce the feature:

https://motherboard.vice.com/read/google-will-soon-shame-all-websites-that-are-unencrypted-chrome-https

http://www.pandasecurity.com/mediacenter/security/websites-that-arent-using-https/

1

The simple answer is that there's no good reason not to. In the past there were arguments about only using SSL where absolutely necessary (e.g. on ecommerce sites collecting payment details).

These were largely to do with the installation procedure for SSL certificates, cost, additional load on the webserver, and network limitations - at a time when people didn't have broadband etc. None of these reasons really apply in 2016.

In terms of SEO, we know that the goal of most search engines is to provide the best results for their users, and this can be done by giving them a secure connection to the site they are browsing. In this respect the search engines do not care whether there is "sensitive" data on the site (either being presented, or collected); it's simply the case that if the site is served over HTTPS, any potential risks of authentication and encryption are greatly minimised, so the site would be considered "better" than the equivalent site without HTTPS.

Essentially, it's so simple and straightforward to implement, it's just seen as best practice nowadays. As a web developer, I just consider installing an SSL certificate and then forcing all requests over HTTPS (very easy using .htaccess or an equivalent) to be a standard part of any site or web application I build.

1

In addition to the other answers, browsers should (as in RFC 2119) send the User-Agent header. It provides enough information about what platform a user is using if he sends the actual User-Agent. If Eve can eavesdrop on a request made by Alice, and Alice sends the actual User-Agent, Eve will know what platform Alice uses without Alice making a connection to Eve's server. It will be easier to hack into Alice's computer with such knowledge.

  • This is a bit like saying that if Eve can see Alice's car's VIN number through the car's windshield, it makes it easier for Eve to break into Alice's car because the VIN number allows her to find out what brand and model car Alice owns. Sure, it's a possibility, but there are tons of ways to get much the same information without MITM'ing anything, in ways that would barely register as anything more than the Internet background noise for a leaf node on the network. For example: Eve (or perhaps Mallory) could e-mail Alice a link to a web page under their control. People love to click on links. – a CVn Jul 17 '16 at 18:40
1

You have two options to secure your main domain (mysite.com) and its sub-domains (play.mysite.com and test.mysite.com). SSL is not only for ecommerce, payment merchant sites where financial transactions or login credentials are shared over the website. It is as equally important for content-based website. Attackers always search for plain HTTP website or loophole in website. SSL not only provides security but also authenticate your website. The main benefit of having SSL on content-based website is that,

  • You can avoid man-in-middle attack that can alter content of the site.

  • Besides, your website will have authenticity that notifies visitors that their information will be secured if they share with the website.

  • They get assurance about website authenticity.

  • Moreover, your website will be free from injection of malicious ads, exploits, unwanted widgets, software replacement, and harm to web pages once you have SSL on your website.

  • SSL certificate offers static site seal that can be placed on any web page for assurance and customers can click on the seal to know the details of installed SSL certificate.

1

Other answers talked about the benefits of HTTPS. By would a user be forced to use HTTPS? For two reasons:

  • If you give users the option to not use HTTPS, they probably won't, especially since most browsers default to http:// and not https:// when typing a domain in the address bar.
  • By implementing both a secure version and an insecure version, you increase the attack surface of the connection. You give attackers the chance to perform a downgrade attack even if you think that you are using the secure version.
  • If you redirect every http:// URL to the equivalent https:// one, it makes life easier for the admin of the server and for search engines. No one has to worry about whether the http:// and https:// are meant to be equivalent or meant to point to completely different things, by redirecting one to another it's clear to everyone what URLs are meant to be used.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.