Recently, I notice that while using Google search, I am connecting to Google's server using UDP instead of TCP on both port 80 and port 443. It seems that Google is experimenting with some new technology related to SPDY QUIC or HTTP/2.0.

Since UDP is a connectionless protocol, it can be spoofed easily. Does this not make HTTPS over UDP insecure?

  • Yes, it's QUIC, and relies on the transport being connectionless for some of its features.
    – grawity
    Dec 15, 2014 at 8:49

1 Answer 1


HTTPS over UDP is secure. This is because the security of HTTPS doesn't use any of the properties of TCP except that it is a transport layer. Just like UDP, TCP is easy to spoof and manipulate. TCP is only to make things more reliable, not more secure. With UDP, packets can be doubled, missed or sent in the wrong order. TLS is a means to fix these issues. TLS works on UDP instead of TCP. But then those issues would make the encryption more likely to break on one side, and the connection would fail.

If you start to add error correction and other features to higher protocols like TLS, you basically re-build TCP, which is bad as then you have to maintain (and build) your own TCP stack with all the problems this introduces.

The UDP connections you are observing are most likely not SPDY, as SPDY uses TCP for transport.

  • 4
    note: TLS over UDP is 'well defined' as DTLS (datagram TLS). I have submitted an edit to include this in your comment, and to change what looked like a couple typos saying TLS instead of TCP when comparing transport protocols to UDP. Please correct (if edit is accepted) if I mistakenly changed your intent.
    – atk
    Dec 14, 2014 at 5:49
  • Thanks. Can I say that reliability of a connection does not affect its security at all? Dec 14, 2014 at 12:23
  • 1
    @QuestionOverflow technically, reliability is related to security. For example, if the server is not reliably accessible, then it's DOS. However, UDP turns out to be surprisingly reliable and the impact upon reliability is likely to be so small that it is acceptable,
    – atk
    Dec 14, 2014 at 13:24
  • 3
    What if re-building TCP is the explicit intention?
    – grawity
    Dec 15, 2014 at 8:51
  • But what if only very small data transfer is needed? In this case, an udp packet interchange could be much more efficient, especially if there is no security concern or it is protected with tls.
    – peterh
    Dec 15, 2014 at 18:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .