These days we observes trend to use HTTP over TLS (HTTPS) for all communication. It recommend all weighty Internet service vendors and that claims to good practice. But TLS suite have 3 options for different purposes:
- Certificate verification to ensure server authority.
- Hash verification to ensure the HTTP package is not mangled by network equipment, Man-in-the-Middle, ISP, etc.
- Encrypt data to hide it from reading for Man-in-the-Middle.
First two options makes sense for all type connection. But third makes sense only for sensitive data. Suppose user open public PR site or public library. What the sense add encryption overhead to that data? The same situation with TLS compression and regular HTTP compression in TLS channel. Compression deprecated due CRIME and BREACH attacks vulnerability of encrypted data and that may be used for public data.
In the same time common browsers don't support NULL encryption. You can ensure on ssllabs.com test
I checked Chrome/54.0.2840.100 and Firefox/49.0 and both don't support TLS_RSA_WITH_NULL_SHA or similar