Update 2015: stackoverflow.com scores rating A on the SSL Labs server test, as does say security.stackexchange.com. That's in the top 13% of sites according to the SSL Pulse survey. Thank you Stack Overflow, and well done. (For extra credit, try to make the A+ grade on par with twitter.com and mail.google.com)
HTTPS should be universal. Why? The status quo of 'http except for ecommerce sites' is dire:
- Intelligence agencies are conducting mass survillance (NSA's Prism, GCHQ's Tempora) against everyone.
- Malicious/compromised networks can steal accounts. (Should you trust your ISP, your mobile network, the wireless at the cafe? No, no, no!)
Again, HTTPS should be universal. There's consensus.
- Facebook, Twitter, Google are all HTTPS. Their reputation depends on their users' security.
- HTTPS is made mandatory by the http 2.0 draft specification
Yet many sites are reluctant to adopt HTTPS. They say:
- It's expensive
- It's difficult
Google refute the expense https://www.imperialviolet.org/2010/06/25/overclocking-ssl.html
The ‘S’ in HTTPS stands for ‘secure’ and the security is provided by SSL/TLS. SSL/TLS is a standard network protocol which is implemented in every browser and web server to provide confidentiality and integrity for HTTPS traffic.
If there's one point that we want to communicate to the world, it's that SSL/TLS is not computationally expensive any more. Ten years ago it might have been true, but it's just not the case any more. You too can afford to enable HTTPS for your users.
In January this year (2010), Gmail switched to using HTTPS for everything by default. Previously it had been introduced as an option, but now all of our users use HTTPS to secure their email between their browsers and Google, all the time. In order to do this we had to deploy no additional machines and no special hardware. On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10KB of memory per connection and less than 2% of network overhead. Many people believe that SSL takes a lot of CPU time and we hope the above numbers (public for the first time) will help to dispel that.
If you stop reading now you only need to remember one thing: SSL/TLS is not computationally expensive any more.
And encourage every site to shore up their security https://www.imperialviolet.org/2011/02/06/stillinexpensive.html
All sites should deploy HTTPS because attacks like Firesheep are too easy to do. Even sites where you don't login should deploy HTTPS (imagine the effect of spoofing news websites at a major financial conference to headline “Market crashes”). And you should use HSTS to stop sslstrip.
SSL is just not that computationally expensive any more. Here are the real costs of HTTPS deployment these days:
- Virtual hosting still doesn't work in the real world because Microsoft never put support into Windows XP.
- Sorting out mixed content issues on your website.