From time to time one of the websites I browse regularly becomes a victim of a DoS/DDoS attack and usually they solve the problem by switching to https. I cant see the connection between the attack and the defense? TLS encrypts the connection what does this have to do with the number of connections that consume the server's resources?
The only reason switching to HTTPS might help is if the attack is focused on only HTTP. There is no inherent DOS protection in HTTPS. In contrary, you could probably tie up the resources of the server with HTTPS with even less efforts if you start with a minimal SSL handshake so that the server has something to do but never continue with the SSL handshake after the server has sent its response.
Two things might make a difference here:
If you switch from HTTP to HTTPS, you're switchings ports and protocols. It's effectively a different site. So the attacker would have to modify his attack to target the HTTPS site instead. Many DDoS attacks aren't nearly that sophisticated, so switching protocols could be all it takes.
HTTPS requires more complexity on the client side than HTTP. Many bots used for this type of attack aren't particularly advanced, and HTTPS could be beyond the capability of the code in use.
HTTPS uses a different port than regular web sites, hence many DDOS attacks that are attacking a web site directly via port 80 will get no response from a site expecting (and only responding to) HTTPS ports (443 instead of port 80)
There are a few poorly thought out answers on here. A DDoS can be one of a few different attacks, all using numbers to overwhelm a site:
- Page generation attacks. Make the server(s) generate CPU-expensive pages for lots of users in a way that can't be cached. This slows the whole thing down.
- Flood attacks to fill SYN queues
- Bandwidth exhaustion
They don't "fill up" port 80 and leave the rest of the server and network alone.
Given that HTTP and HTTPS are usually served from the same machine, in the same network, behind the same routers... There is zero protection afforded from just making HTTPS available. It is a different port but so what?
The only case in which that will make a difference is if you're getting page-generation attacks on HTTP and to work around it, you disable :80 HTTP and only use :443 HTTPS. But:
- This breaks it for all your users (and Google) who use port 80. Wasn't that the goal the attacker wanted?
- 301 redirecting them automagically will (likely) redirect the attack
- Even if it doesn't DDoSes aren't hard to change. They're remote controlled computers. An attacker can easily change the order.
This won't help with network flood attacks. This might temporarily(for the same reasons as above) help with bandwidth exhaustion.
If you want to protect against a DDoS you hide the servers that are generating the pages (so attackers can't communicate with it directly) and you use a very large, very robust network of balanced proxy servers. This is essentially what CloudFlare is, on a global scale.