Question

I’m new to web security.

Why would I want to use HTTP and then switch to HTTPS for some connections?

Why not stick with HTTPS all the way?

Answer 1

There are interesting configuration improvements that can make SSL/TLS less expensive, as described in this document (apparently based on work from a team from Google: Adam Langley, Nagendra Modadugu and Wan-Teh Chang): http://www.imperialviolet.org/2010/06/25/overclocking-ssl.html

If there’s one point that we want to
communicate to the world, it’s that
SSL/TLS is not computationally
expensive any more. Ten years ago it
might have been true, but it’s just
not the case any more. You too can
afford to enable HTTPS for your users.

In January this year (2010), Gmail
switched to using HTTPS for everything
by default. Previously it had been
introduced as an option, but now all
of our users use HTTPS to secure their
email between their browsers and
Google, all the time. In order to do
this we had to deploy no additional
machines and no special hardware. On
our production frontend machines,
SSL/TLS accounts for less than 1% of
the CPU load, less than 10KB of memory
per connection and less than 2% of
network overhead. Many people believe
that SSL takes a lot of CPU time and
we hope the above numbers (public for
the first time) will help to dispel
that.

If you stop reading now you only need
to remember one thing: SSL/TLS is not
computationally expensive any more.

One false sense of security when using HTTPS only for login pages is that you leave the door open to session hijacking (admittedly, it’s better than sending the username/password in clear anyway); this has recently made easier to do (or more popular) using Firesheep for example (although the problem itself has been there for much longer).

Another problem that can slow down HTTPS is the fact that some browsers might not cache the content they retrieve over HTTPS, so they would have to download them again (e.g. background images for the sites you visit frequently).

This being said, if you don’t need the transport security (preventing attackers for seeing or altering the data that’s exchanged, either way), plain HTTP is fine.