Hacker News Reader

Is using some other encryption for client interactions common vs just using TLS? I don't think I've seen anyone ever recommend any of these things.

"You can't simply send a single Javascript file over SSL/TLS. You have to send all the page content over SSL/TLS."

Is this a common problem in some way? It doesn't seem like a big deal unless you are trying to shave a few bytes off of your traffic.

View on HN

The article is from 2011. Certs were expensive back then. People thought TLS was an unnecessary hassle, difficult to configure etc. There was an idea that you just do the really important parts (logins, authorizing fund transfers) over TLS and do the mundane stuff offer HTTP. (Static site assets) XSS was so rampant they gave it its own acronym. The natural extension of that was to do everything over HTTP and for the handful of objects that need to be secured, you just encrypt those ~100 bytes of important data.

Then let's encrypt happened and all that went out the window.

It was more common before than it is now; LetsEncrypt has probably killed the practice off. But what really motivated this was stuff like CryptoCat.

Reply on news.ycombinator.com