tags:

views:

215

answers:

7

Why would you not use https on your public facing website?

For SEO purposes? For performance reasons? Why don't more companies use https on their public facing site.

Even the founder of mint.com mentions not using https on his public facing site" http://cnettv.cnet.com/rr03-mint-ceo-aaron-patzer/9742-1%5F53-50076867.html 19min into the interview the founder of mint mentions "it is for SEO purposes"

+6  A: 

I suppose one example would be that you don't need it (no authentication, for example) and you don't want to shell out the cash for an SSL Certificate?

Pandincus
I believe if you don't purchase a cert from one of the well known 'Certification Authorities,' you can generate your own for free. The downside of this is that users have to explicitly accept your cert when they first visit your site. This can confuse confusion-prone users plus doesn't look terribly professional (IMO).
Jay Riggs
Good point -- yeah, although it can be done, its never fun when a viewer goes to your site and sees a huge warning.
Pandincus
+6  A: 

Performance is the only reason to not force HTTPS (aside from simply not needing it). You shouldn't ever make security decisions based on "SEO".

Noon Silk
The CEO of mint.com mentioned that he doesn't use https on the homepage due to SEO, so that is part of the reason I am asking what I am asking.
Daniel
+1  A: 

Not all browsers support HTTPS. Think cell phones and other lightweight devices.

mahboudz
Surprisingly, most cell phones does support SSL.
Noon Silk
@silky: This doesn't surprise me at all. It surprises me that it would surprise anyone.
Asaph
Very interesting!
Daniel
+3  A: 

For login pages, hopefully more will. See The Fundamentally Broken Browser Model.

TrueWill
+1  A: 

There is a performance hit incurred when visiting sites behind SSL... it's usually not a lot, but sometimes (under some confluence(s) of conditions) it can actually be noticeably slower.

eidylon
+1  A: 

There is a performance hit when first negotiating a connection with the website. This has to do with the handshake that SSL does, sending information back and forth. Try sniffing your browser (HTTP Live Headers) when you're making an SSL connection to see how much goes on behind the scenes.

There is also a computation hit on the server to create the SSL connection (it's CPU intensive, much like all crypto key-related operations).

Jarrod N
A: 

Let me turn it around and ask you why you would not use http on your public facing website? If all the information is publicly available and there is no reason anyone would want to have it not publicly knowable that they are hitting your site, then there's no reason to go to the trouble of https.

ysth