Why should i use ssl?

Question

I'm running a dating site and not using SSL at the moment.

I've noticed major sites like facebook and twitter do not use https for login but just use plain old http, is there really any advantage to https-ing my site or it is only for cc transactions or so ?

thanks in advance.

Answer 1

SSL is used only when transmitting sensitive data between browser and server. It's fine for major sites like facebook and twitter to use http (as long as the data is not sensitive). Most website use SSL for their login page. SSL also used by payment gateway to safely transfer payment information through the wire.

And by the way, http is not "plain old" and https is not new trend either :)

Answer 2

If your users are providing any sensitive data, ssl prevents it from being intercepted by a third party. If you don't use SSL, you should assume that some third party can see everything that every one of your users does on your website. If you are comfortable with them seeing this information, then keep it plain http, but if you don't like that thought, go https.

Another benefit of ssl is that it allows the use of Strict Transport Security, which not only forces https on all site activity, but also prevents a man in the middle from spoofing your site to a user and making them think they are accessing your site. Details here: http://en.wikipedia.org/wiki/Strict_Transport_Security

Answer 3

SSL encrypts the traffic between the browser and the server. So virtaully anything you want to be secure needs to be ssl'ed. Google search is even doing it so poeople can't have their search terms intercepted.

Its just the case of what YOU want secure, and if not having certain parts of your site secure will keep wanted customers away. I would think a dating site has a lot of personal demographics information that some people might want secure... just my 2 cents.

Answer 4

I work at a major ISP and am infatuated with one of your online members. By sniffing your packets, I can find out when and where she's meeting another member, rewrite the packet to change the location so the other guy doesn't show up, and then make my move.

You decide whether that's acceptable to your users.

Answer 5

Https is useful to protect the credential (user/password) , but it increases the network load and requires more CPU resource (encryption). Thus, it is common to use only for authentication. Https ,with server certificate protects again phising.

Banks uses end to end application

Answer 6

Actually, facebook does use https for its login:

<form method="POST" action="https://login.facebook.com/login.php?login_attempt=1" id="login_form">

as does twitter:

<form method="post" id="signin" action="https://twitter.com/sessions"&gt;

You'll notice they don't use https for the page that displays the signin form. That's because it isn't necessary.

However, it's a good idea to use ssl the login itself if you can, if only because so many users employ the same password for all sites.

One solution, which I'd like to see more sites employ, is using OpenID/OAuth for login instead of requiring a username/password.

Answer 7

See http://www.sslshopper.com/article-do-i-need-an-ssl-certificate-for-my-website.html