Hacker News Reader

Comment by drdaeman | Hacker News Reader

> For a public blog that doesn't accept submitting any information

TLS is not about accepting information, it's about ensuring that the connection's encrypted and authenticated.

It is still important to prevent unauthorized third parties from watching which articles you're reading. And it's still important that you know that you're reading a blog you expect to read, not a modified version served by someone else (although CA system isn't completely sufficient for this, at least it thwarts less-powerful adversaries from spoofing).

View on HN

Sure, but it's a tradeoff between authentication and speed, in which many people may want to choose speed.

I'm having some difficulty thinking of a scenario where, given the choice, I'd trade off authentication for speed. The information would have to be of so little value that it doesn't matter if the remote party gets what I send or if I get what the remote party sends.

You're assuming that the probability of interception is 100% In reality, the probability of interception is miniscule, but the probability of speed is 100%.

The probability of interception is massively higher than miniscule, see the recent wide scale hijacking of Chinese traffic to DDOS Github or ISPs inserting ads and tracking into responses.

These types of attacks have been hypothetical for a long time, but we're starting to see real world impacts of not using https, and they aren't trivial.

I made an events site for my city:

http://www.tithess.gr/

The Greek government inserting ads into that site is very low on my list of concerns, but the additional 200-400ms on the first page load is much higher up.

Am I correct in understanding your point as "there can be no conceivable case where two fewer TCP roundtrips would be worth the speed gain over the decreased security"?

Weren't speed differences shown to be negligible?

Unless someone care about a single extra round-trip timing, e.g. extra 10-300ms with 300 being quite a stretch? I'm sure it doesn't matter if a blog page opens in 40ms or 55ms - a reader won't tell the difference.

I'm consistently seeing a 500ms difference between http://www.stavros.io and http://www.stavros.io with `time curl http://www.stavros.io`.

Reply on news.ycombinator.com