Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

So, I've been looking over various websites that don't handle confidential information per se, but do accept user authentication tokens (i.e. you can create accounts with them and associate an e-mail/username with a password).

Specifically, I've been checking to see whether they implement any kind of protection with regards to these tokens, and I've been finding a disturbing number of sites simply send these tokens as plaintext POST data.

Many sites do encrypt, despite the fact that they don't handle confidential information. Other, content-equivalent sites, don't bother.

I've mentioned this to the administrators of the sites I found. One changed policy. Some didn't respond. Once used the argument that a lot of other sites don't do it, so he shouldn't bother, and it might be prohibitively expensive.

Obviously, the 'bystander effect' argument is an awful one. But since I don't have the numbers, and would default to using SSL myself, is implementing this basic security feature really all that expensive?

Or, more specifically, his argument was that his site wasn't large enough to make the financial investment worth it. Is this an argument that makes sense?

-- And, not strictly important, but I'm curious --

Has any research been done on how many people are careful about password use? Has anyone ever put a sniffer near a public wifi and checked to see whether this could be a problem in practice for John Q. Public?

EDIT: Also, relating to that last, not-strictly-necessary, question... In order to do a conclusive study on this subject and draw realistic conclusions, it seems like someone would have to break a number of laws, even if they were very careful in the way they handled the data, and used it for nothing apart from the study. Are there currently avenues in place by which this type of research can be done in a legal, controlled, responsible manner?

share|improve this question
    
Since StartCom offer free SSL single-domain certificates (startssl.com) with the www. subdomain included, the cost of the actual certificate can be negated most of the time. I'd like to see costs of configuration overhead, maintenance, extra CPU, etc. in an answer. A study on the costs of lost sales due to lack of SSL would be nice too, as a comparison. –  Ladadadada Mar 5 '13 at 16:16

1 Answer 1

up vote 4 down vote accepted

SSL is not expensive by itself. When implementing site-wide SSL for Gmail, Google found it to increase CPU load by about 1% and network load by about 2%. Of course, not every site is Gmail. Biggest costs about SSL are:

  • You have to manage a server certificate. The buying fee is small, much smaller than the administration time anyway, and it won't get far.
  • Transparent proxies (as employed by some ISP) won't be as efficient (but that's their problem, not yours).
  • The initial connection to your site is a bit longer (but we are talking about a one-shot sub-second delay here).

There is a widespread myth about how encryption is necessarily expensive, and that's just that: a myth, i.e. a much deformed piece of information from much older times. A basic server will support 100 MBit/s SSL with less than 10% of a single CPU core. In 1996, when a server could be a 33 MHz 80386, SSL could be viewed as expensive, but this was quite some time ago.

share|improve this answer
    
Although you didn't address the financial cost, yours was a good answer, and hopefully a helpful one to anyone else who looks for this information. Since I don't have the reputation to upvote it, I'm accepting it. Thanks! –  root Mar 6 '13 at 1:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.