HTTPS而不是HTTP？

Question

I'm new to web security.

Why would I want to use HTTP and then switch to HTTPS for some connections?

Why not stick with HTTPS all the way?

Answer 1

There are interesting configuration improvements that can make SSL/TLS less expensive, as described in this document (apparently based on work from a team from Google : Adam Langley, Nagendra Modadugu and Wan-Teh Chang): http://www.imperialviolet.org/2010/06/25/overclocking-ssl.html

If there's one point that we want to communicate to the world, it's that SSL/TLS is not computationally expensive any more. Ten years ago it might have been true, but it's just not the case any more. You too can afford to enable HTTPS for your users.

In January this year (2010), Gmail switched to using HTTPS for everything by default. Previously it had been introduced as an option, but now all of our users use HTTPS to secure their email between their browsers and Google, all the time. In order to do this we had to deploy no additional machines and no special hardware. On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10KB of memory per connection and less than 2% of network overhead. Many people believe that SSL takes a lot of CPU time and we hope the above numbers (public for the first time) will help to dispel that.

If you stop reading now you only need to remember one thing: SSL/TLS is not computationally expensive any more.

One false sense of security when using HTTPS only for login pages is that you leave the door open to session hijacking (admittedly, it's better than sending the username/password in clear anyway); this has recently made easier to do (or more popular) using Firesheep for example (although the problem itself has been there for much longer).

Another problem that can slow down HTTPS is the fact that some browsers might not cache the content they retrieve over HTTPS, so they would have to download them again (eg background images for the sites you visit frequently).

This being said, if you don't need the transport security (preventing attackers for seeing or altering the data that's exchanged, either way), plain HTTP is fine.

Answer 2

Mostly performance reasons. SSL requires extra (server) CPU time.

Edit: However, this overhead is becoming less of a problem these days, some big sites already switched to HTTPS-per-default (eg GMail - see Bruno's answer).

Answer 3

If you're not transmitting data that needs to be secure, the overhead of HTTPS isn't necessary.

Check this SO thread for a very detailed discussion of the differences. HTTP vs HTTPS performance

Answer 4

And not less important thing. The firewall, don't forget that usually HTTPS implemented on port 443. In some organization such ports are not configured in firewall or transparent proxies.

Answer 5

HTTPS可能非常慢，对于像图像这样的东西也是不必要的。