Why is HTTPS not used for all web traffic?

Why is HTTP still used?

When was the last time you wrote a PHP script which actually communicated with a remote machine?

We've been doing it for ever and we get by just fine. I want to present a case of when designing a REST web server where you can make no assumptions about what the client knows or will do, when the request protocol should be defined and why it makes sense. Web application in PHP. Imagine a typical web application running on a Linux server. A simple cron job runs the database dump and the backup script for a database. The dump creates a backup for an entire day's data and the backup script sends the backup to a second server for storage via HTTP. The system runs well so far. The backup is stored and you are notified that you have been backed up correctly. Now imagine that your backup is sent too early, thus causing the data to be stored for over a month without the user even noticing.

The cron job ran to a timestamp set by localtime which was the time that the current hour became the current hour at 0:00. You'll notice that you can be sure that the date is the correct one by comparing the timestamp used by that particular file to the UTC time which is known, assuming that the cron script is correct.

This means that we have to work only based on GMT and this will be of no harm when dealing with time zones or when communicating with timezones. This information could be added to the backup header. Since PHP stores timestamps internally as seconds since 1st January 1970 it is sufficient to compare them without any extra formatting. This is why time differences between computers is always going to be in seconds as most common systems like Unix already calculate seconds from the beginning of 1970.

What would you do instead of the above cron script.

What is better, HTTP or HTTPS?

This question has been discussed on Stackoverflow for years and in many cases is not the answer.

In a recent discussion I was in, it was stated that HTTPS is better than HTTP because it is more secure and also because it provides a "proper" standard for securing websites. While I agree with the statement that HTTPS is more secure and offers more security for websites, this is not the only reason to use HTTPS. I would like to know what other reasons are there for using HTTPS over HTTP. In addition to the more secure (SSL) connection between your browser and web server, there are other reasons to use HTTPS. You get to keep a copy of the site's login and password as plain text in your web browser. With an SSL connection you would have to do something like storing the credentials in an encrypted cookie.

You may also want to restrict access to the site based on your IP address. You can't do this with plain HTTP.

The most obvious one is to protect against "Man in the middle" attacks. If you are using HTTP, someone can intercept your traffic and see everything you send and receive. If they can change the headers in your HTTP messages, they can impersonate you, or even impersonate other people. For example, if you are using email, you could send a message to somebody and the attacker could see the contents of that email.

This is no longer an issue if you're using https. Another is to prevent eavesdropping. In an encrypted channel, you're less likely to be heard by others. This can be a problem if you're communicating with a public computer or one where people are near by.

The other reason is to have authentication of the site. If you log into a website, you usually see a page with a login form. If you go to a non-https site, you can't see the form at all. It's protected behind the scenes by some sort of login process. This is also important if you're giving out passwords. If you have a link to a password protected page, it should be https.

You can use HTTPS for authentication. The server generates a secret key, encrypts it using the private key of the certificate, and sends it back to the client.

Why is HTTP not secure?

- jakehg
======.

shadfaq. Good point about SSL's role in this situation. Even before the current CA mess -- which is what I think you are alluding to in your question -- certificates. Had proven to be a big failure for large scale deployment of HTTPS due to its. Complexity and the number of dependencies that need to be met for a certificate. To be properly configured. There were various other concerns with the CA model as well that were addressed when TLS was designed that made it a bit more. Sensible in certain respects. Still, TLS is complex.

It is also very confusing. SSL had simple rules and one set of requirements.

HTTPS has multiple protocols that have different sets of rules for different. Features and some protocols have to be negotiated by client and server. It's also got two different models of security: confidentiality (SSL/TLS) and. Authentication (OCSP/CRL/TLSCERT). And there are two fundamentally different ways in which the protocol might be used: for securing information between two. Servers, or between one server and another. For all these reasons (and others) it's not surprising that HTTPS is actually. Pretty much impossible to deploy on the kind of scale where it can be made. Effective. The situation gets even worse when you consider how many servers need access to certificates anyway. It doesn't require much imagination to think that if you have ten million servers, all of which need to be able to. Access certificates in the root store, you need a root store (or many), and. That's expensive. So most organizations are probably buying their root keys from a CA anyway. There are just too many moving parts for SSL/TLS to be really feasible for. Anything but small scale deployments. In an ideal world you would get CAs to offer free, unlimited certificates for any server that wanted to serve. Content, but that's never going to happen in reality.