Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

So https is supposed to be safer than http (encrypted), why is https then not used everywhere? Would it not make the web a more safe place? What could be the reason that https is not implemented when it does improve security?

share|improve this question

closed as off-topic by slhck May 11 at 11:43

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question is not about computer hardware or software, within the scope defined in the help center." – slhck
If this question can be reworded to fit the rules in the help center, please edit the question.

2  

1 Answer 1

I could not resist to copy-paste this time. Read this detailed explanation (I am not original authror, here is link to the source). Also don't be shy and use Google next time.

There are a couple of reasons first let me explain the differance: http send everything you do in plan text for any one to read.

https encrypts everything you do so that no one can read what you type but the recipient.

The problem with encrypting data is that you cant just encrypt it and say only yahoo can read it. Both you and yahoo have to have a secret key so that yahoo can decrypt what you sent and encrypt private stuff for you to read.

This is accomplised by an encryption scheme known as public key. Yahoo puts out a public key so that every one can encrypt stuff that only yahoo can read its like a one way key: you can package stuff up and send it to yahoo so that they can read it with theire private key but some one with a public key cant see what you encrypted.

So you package up a key for yahoo to use to talk to you and you are all set.

WHY ALL internet communication isn't done like this is because of what is known as the man in the middle attack, and its solution.

It's quite simply to pretend to be yahoo.com if you know what you doing. so I pretend to be yahoo and all traffic you think is going to yahoo comes to me. you ask me for my public key I respond back with an fake public private key pair that I made then I ask yahoo for there public key and every thing you to I do I just watch for anything interesting like Credit cards etc, an you are non the wiser.

We solved this problem by using what is called a certificate authority. A CA is some one who you pay to vouch for you; Verisign and GoDaddy are the biggest. So everytime you make a https connection to amazon you go to a CA and they comeback with amazons public key. And every thing is hunky doory. With the exception that this slowed you down considerable yahoo.com has to pay a CA bill every month, and joesmoh.com has to go through a lot of rigormarol to set all this up.

And finally I will answer your question: So the reason is it would make every thing slow more expensive and more complicated to use exclusively https.

Plus tying to get information from internet traffic once it is out of your local network is like trying to car jack someone on free way going 500 miles an hour. enough security for you typical fried chicken recipe.

Complicated answer but you asked a complicated question.

share|improve this answer
    
That reference to Google is inappropriate –  nixda May 11 at 11:45
    
@nixda I would argue about that. I did answer the question by quoting a good detailed answer from another source. By referencing google search I have merely reminded a new member that it is worth conducting a simple research before asking a question. Though I agree that it would be inappropriate to just reference google without attempting to answer –  smc May 11 at 11:50
    
The point is, that stackexchange should be THE source. A new user shouldn't use google to find an answer somewhere else than on stackexchange. If you find a source, copy/summarize/extend it. If you reference the source, even better. But don't encourage people to just google it and find it somewhere else –  nixda May 11 at 12:02
    
@nixda : You could really benefit from reading meta thread that you have linked in your previous comment. It clearly points out the benefit of mentioning exact query that helped to find quoted result. There is nothing wrong with mentioning Google query along with an answer, as long as it is not intended to insult OP. This is exactly what I did. –  smc May 11 at 12:07
    
And you really think Also don't be shy and use Google next time isn't just a friendly way to say "You're lazy"? Hey, it's ok. You have your opinion, I have mine. I wouldn't do this –  nixda May 11 at 13:20

Not the answer you're looking for? Browse other questions tagged or ask your own question.