- for very high traffic websites HTTPS costs a lot of money. .gov sites are not very high traffic.
- When you have such high traffic you also have a bunch of old winxp and similar clients. These dont work fast on HTTPS and dont work without sslv3 and what not.
So while HTTPS with safe settings works in most cases it doesnt work in all cases.
https://www.imperialviolet.org/2010/06/25/overclocking-ssl.h...
http://blog.codinghorror.com/should-all-web-traffic-be-encry...
Although you may argue that if you are a CDN, encryption can be a significant portion of your costs.
Also, Jeff Atwood writes following:
> Of course, there's no reason to encrypt traffic for anonymous, not-logged-in users, and Twitter doesn't. You get a plain old HTTP connection until you log in, at which point they automatically switch to HTTPS encryption. Makes sense.
Today we know that it is no longer a valid point. TOR users can be deanonimized by injecting traffic into plain HTTP connections. Upgrade to HTTPS seems to be fixing that. So we really should use HTTPS by default and HTTP only in very well articulated cases.
.gov sites can be very high traffic. Think weather, social security, health care, immigration, visas...
> - When you have such high traffic you also have a bunch of old winxp and similar clients. These dont work fast on HTTPS and dont work without sslv3 and what not.
SSLv3 only kills IE6, which is doable. And it's okay if very old clients work slowly with HTTPS -- those clients have far more problems than just slow HTTPS.
Killing IE6 and some others (java clients, etc.) is not always doable and thats the point. its doable for many but not all.