A lot of web applications (Facebook and Twitter, for example) provide SSL support, but don't make browsing with SSL the default option--you have to opt-in manually. Is there some kind of major drawback to using SSL that I'm not aware of? It seems to me that browsing with SSL is clearly better than browsing without it. Why wouldn't these companies make SSL the default for their web apps?
1
-
I’m voting to close this question because it's not about using a specific web application. It might be on-topic in Super User or Information Security.– Rubén - Volunteer Moderator - ♦Commented Oct 15, 2023 at 2:06
Add a comment
|
4 Answers
It's all in the handshake.
A connection over TCP, like http://..., uses a three-part handshake:
Client --> syn,
Server --> syn ack,
Client --> ack
SSL uses a much longer sequence. This site says SSL (https://...) uses about 4 times more packets, and has 3.5x more latency than http://
-
But after the handshake, isn't the overhead basically negligible? Commented Feb 11, 2011 at 2:48
They'll eventually make SSL default, but they're just not there yet. Google is using permanent SSL only on GMail. I believe it'll take at least a year for Facebook to enable it everywhere. The biggest problem now on Facebook is with canvas apps. If you enable permanent SSL for your profile, then all iframe embedded apps need to run it as well and this requirement has very serious consequences - all app developers need to have their servers certified. This costs not only money, but also a lot of CPU time if not configured properly.
SSL for certain pages, such as a login form or shopping cart, would be no big deal. However, when it's for every page on the site, the site's overhead grows accordingly. If you were to switch on SSL by default for all users, the site's overhead would take a big jump. Hence the reason to make it an option for those who care.
answered Feb 11, 2011 at 1:36
-
Isn't the overhead only for the handshake though? That's what I always thought, but I could be wrong. Commented Feb 11, 2011 at 2:49
-
2That's how I understand it, but the difference is that if SSL was on by default, everyone visiting any page would go through the process. Commented Feb 11, 2011 at 5:17
SSL often requires much more server power for each connection due to needing to generate/decipher the code. While on a small site this might not be noticeable, high volume sites with millions of visitors per minute have to add significant amounts of server power to handle the overhead. That's the main reason sites like Gmail, Yahoo Mail, and Hotmail initially rolled out their SSL logins as an optional feature, and it is why many websites today still limit encryption to their login forms.
