Take the 2-minute tour ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.

A lot of web applications (Facebook and Twitter, for example) provide SSL support, but don't make browsing with SSL the default option--you have to opt-in manually. Is there some kind of major drawback to using SSL that I'm not aware of? It seems to me that browsing with SSL is clearly better than browsing without it. Why wouldn't these companies make SSL the default for their web apps?

share|improve this question

4 Answers 4

up vote 5 down vote accepted

It's all in the handshake.
A connection over TCP, like http://..., uses a three-part handshake:

Client --> syn,
Server --> syn ack,
Client --> ack

SSL uses a much longer sequence. This site says SSL (https://...) uses about 4 times more packets, and has 3.5x more latency than http://

share|improve this answer
    
But after the handshake, isn't the overhead basically negligible? –  musicfreak Feb 11 '11 at 2:48

They'll eventually make SSL default, but they're just not there yet. Google is using permanent SSL only on GMail. I believe it'll take at least a year for Facebook to enable it everywhere. The biggest problem now on Facebook is with canvas apps. If you enable permanent SSL for your profile, then all iframe embedded apps need to run it as well and this requirement has very serious consequences - all app developers need to have their servers certified. This costs not only money, but also a lot of CPU time if not configured properly.

share|improve this answer

SSL for certain pages, such as a login form or shopping cart, would be no big deal. However, when it's for every page on the site, the site's overhead grows accordingly. If you were to switch on SSL by default for all users, the site's overhead would take a big jump. Hence the reason to make it an option for those who care.

share|improve this answer
    
Isn't the overhead only for the handshake though? That's what I always thought, but I could be wrong. –  musicfreak Feb 11 '11 at 2:49
2  
That's how I understand it, but the difference is that if SSL was on by default, everyone visiting any page would go through the process. –  Grant Palin Feb 11 '11 at 5:17

SSL often requires much more server power for each connection due to needing to generate/decipher the code. While on a small site this might not be noticeable, high volume sites with millions of visitors per minute have to add significant amounts of server power to handle the overhead. That's the main reason sites like Gmail, Yahoo Mail, and Hotmail initially rolled out their SSL logins as an optional feature, and it is why many websites today still limit encryption to their login forms.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.