Linked Questions

109
votes
6answers
23k views

Why should I offer HTTP in addition to HTTPS?

I am setting up a new webserver. In addition to TLS/HTTPS, I'm considering implementing Strict-Transport-Security and other HTTPS-enforcement mechanisms. These all seem to be based on the assumption ...
82
votes
9answers
88k views

Can my company see what HTTPS sites I went to?

At work my company uses internet monitoring software (Websense). I know if I visit a https ssl-encrypted site (such as https://secure.example.com) they can't see what I'm doing on the site since all ...
80
votes
13answers
25k views

What are the pros and cons of site wide SSL (https)?

What are the pros and cons of encrypting all HTTP traffic for the whole site through SSL, as opposed to SSL on just the login page?
66
votes
3answers
7k views

Are URLs viewed during HTTPS transactions to one or more websites from a single IP distinguishable?

For example, say the following are HTTPS URLs to two websites by one IP over 5 mins: "A.com/1", "A.com/2", "A.com/3", "B.com/1", "B.com/2". Would monitoring of packets reveal: nothing, reveal only ...
60
votes
8answers
47k views

Why do browsers default to http: and not https: for typed in URLs? [duplicate]

When I type example.com without any scheme into the browser bar and press Enter it is interpreted as HTTP://example.com, not HTTPS://example.com. Why? And where are the plans to fix this? (To be ...
58
votes
4answers
16k views

Why aren't application downloads routinely done over HTTPS?

We all know we should be using SSL whenever we collect passwords or other sensitive information. SSL provides two main benefits: Encryption: The data can't be read by a middle-man while in transit. ...
27
votes
1answer
24k views

My understanding of how HTTPS works (gmail for example)

I want to ask if my below understanding is correct or not regarding the HTTPS used for the webpage we are visiting. I will use Gmail as an example: My laptop tries to connect to the Gmail server ...
11
votes
2answers
985 views

Why are we still using HTTP? [duplicate]

I've been reading a lot of online articles and blogs about advantages of using HTTPS (HTTP over SSL/TLS) and the performance issues involved in deploying a website over HTTPS. What I understood is ...
5
votes
3answers
2k views

Can serving HTTPS to Internet Explorer on Windows XP be made secure?

Answers to Why is HTTPS not the default protocol? state that a lot of sites still use clear HTTP instead of HTTPS because all of these are true: A substantial number of visitors to the site use ...
3
votes
2answers
392 views

https://www.truecrypt.org forwards to http://www.truecrypt.org

Why is the site doing this? Is that a security flaw? In general, I'd be wary about using a http site instead of a https, although regarding truecrypt specifically, I came to trust it. I wonder why not ...
3
votes
2answers
188 views

If not using HTTPS/SSL/TLS is such a security risk, why don't sites/browsers force HTTPS for all sites that have it?

From my other question Besides Plain-Text passwords, is there anything to worry about with sites that don't use SSL? there are answers that mention all sorts of things that can happen if there is ...
1
vote
2answers
468 views

Why do some HTTPS-enabled websites use HTTP by default?

Some sites like Stack Exchange have an HTTPS version available. But when I type their address or go to them via Google, I get an unencrypted version. This seems to render the HTTPS version totally ...
-1
votes
4answers
132 views

Can SSL deployment incur performance issues [closed]

Does SSL deployment for secure server-client communication incur any performance overhead? I ask myself, why not just use HTTPS for standard web browsing when it is proven that it protects our privacy?...