What is the cost of SSL encryption?

Question

So, I've been looking over various websites that don't handle confidential information per se, but do accept user authentication tokens (i.e. you can create accounts with them and associate an e-mail/username with a password).

Specifically, I've been checking to see whether they implement any kind of protection with regards to these tokens, and I've been finding a disturbing number of sites simply send these tokens as plaintext POST data.

Many sites do encrypt, despite the fact that they don't handle confidential information. Other, content-equivalent sites, don't bother.

I've mentioned this to the administrators of the sites I found. One changed policy. Some didn't respond. Once used the argument that a lot of other sites don't do it, so he shouldn't bother, and it might be prohibitively expensive.

Obviously, the 'bystander effect' argument is an awful one. But since I don't have the numbers, and would default to using SSL myself, is implementing this basic security feature really all that expensive?

Or, more specifically, his argument was that his site wasn't large enough to make the financial investment worth it. Is this an argument that makes sense?

-- And, not strictly important, but I'm curious --

Has any research been done on how many people are careful about password use? Has anyone ever put a sniffer near a public wifi and checked to see whether this could be a problem in practice for John Q. Public?

EDIT: Also, relating to that last, not-strictly-necessary, question... In order to do a conclusive study on this subject and draw realistic conclusions, it seems like someone would have to break a number of laws, even if they were very careful in the way they handled the data, and used it for nothing apart from the study. Are there currently avenues in place by which this type of research can be done in a legal, controlled, responsible manner?

Answer 1

SSL is not expensive by itself. When implementing site-wide SSL for Gmail, Google found it to increase CPU load by about 1% and network load by about 2%. Of course, not every site is Gmail. Biggest costs about SSL are:

• You have to manage a server certificate. The buying fee is small, much smaller than the administration time anyway, and it won't get far.
• Transparent proxies (as employed by some ISP) won't be as efficient (but that's their problem, not yours).
• The initial connection to your site is a bit longer (but we are talking about a one-shot sub-second delay here).

There is a widespread myth about how encryption is necessarily expensive, and that's just that: a myth, i.e. a much deformed piece of information from much older times. A basic server will support 100 MBit/s SSL with less than 10% of a single CPU core. In 1996, when a server could be a 33 MHz 80386, SSL could be viewed as expensive, but this was quite some time ago.