Timeline for Why can't I use https to access the stackexchange sites?
Current License: CC BY-SA 3.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 21, 2011 at 21:45 | comment | added | Shane Madden | @voretaq7 Session hijacking is the risk that SSL would prevent - while's it's obviously not nearly the level of value that someone's facebook or email session cookie would be, I don't think the "there's no need" reasoning really works in that context - the "it isn't worth it" reason is plenty valid, though! | |
| Jul 21, 2011 at 20:50 | comment | added | Chopper3 Mod | As an indication our hardware SSL/TLS boxes cost over £250k for around 65,000 SSL transactions per second - so quite expensive. | |
| Jul 21, 2011 at 20:49 | comment | added | voretaq7 | gmail deals with data you don't want other people to see (your email) :-) | |
| Jul 21, 2011 at 20:40 | vote | accept | mdpc | ||
| Jul 21, 2011 at 20:39 | comment | added | mdpc | Interesting point is that gmail allows for both http:: and https:: access (in fact, I believe https:: is the default access mode). Anyway, thanks for taking the time to more thoroughly discuss the reasoning involved. | |
| Jul 21, 2011 at 20:34 | comment | added | voretaq7 | +1 - To implement SSL on a site that doesn't pass sensitive auth data (you sign in with OpenID, right?) makes little sense. The overhead of doing SSL on front-end web servers (or the astronomical cost of hardware SSL accelerators) would be pretty hard to justify. | |
| Jul 21, 2011 at 20:25 | comment | added | Mark Henderson Mod | Additionally, adding SSL to a website as highly trafficed as the Stack Exchange network is not nearly as simple as just installing a certificate. | |
| Jul 21, 2011 at 20:18 | comment | added | Chopper3 Mod | But your "sessions" (i.e. new questions, answers, comments, chats etc.) are public domain, you don't get privacy with SE, at all (apart from login stuff) - so it'd be unnecessary load on the platform. | |
| Jul 21, 2011 at 20:11 | comment | added | mdpc | But why not allow it? Maybe I don't want my sessions to be eavesdropped on. | |
| Jul 21, 2011 at 20:07 | history | answered | Chopper3Mod | CC BY-SA 3.0 |