Should more sites move to encryption?

I've just read this item in today's Sophos newsletter :-

https://nakedsecurity.sophos.com/2014/11/18/naked-se...

What do members think.?

No need to move to HTTPS if the content is not a privacy problem.... What would the point of encrypting this site be for example? Just wastes CPU resources. Anything that discusses a topic that may be considered private etc, by all means go for it.

If it is trivial website content and isn't a security or privacy problem... give people the option.

Oh yeah, and what about the cost and effort of obtaining SSL certificates?

Yes, people just aren't aware of what information they are giving away about themselves. It's the least a site can do to try and stop this growing surveillance nightmare

Encryption should be the norm, not the exception, so this is good.

You don't use postcards for everything with envelopes as the exception, same bag.

In reply to a post by Pipexer:

What would the point of encrypting this site be for example?

To prevent username + password being snarfed out of the aether when e.g. using a public wi-fi connection.

In reply to a post by Pipexer:

Oh yeah, and what about the cost and effort of obtaining SSL certificates?

StartSSL Class 1 certificates are free https://www.startssl.com/?app=1

The EFF (and various significant partners) are launching the "Let's Encrypt" CA around the middle of next year which will provide free basic certs as well: https://www.eff.org/deeplinks/2014/11/certificate-au...

This move will force all the major CAs to dish out Class 1 certs for free in the long run I think.

HTTPS will not prevent a snooper knowing which web site you're looking at. Not only can you see which server the connection is going to, but the SSL certificate contains a name for the site in plain text. All it will do is hide which page you're looking at.

Yes, it will be noted you contact the google, Barclays Bank, or Dr Practice, but the metadata will be hidden, so no one will know that you are interested in s&m, or checking bank loan rates, or curious about cancer prognosis and treatment.

Yes it probably can be compromised by 'the man' but still takes time and money to do.

there are at least 2 free VPN out there, if you want total data obfuscation.

Also it makes the 5? year data retention by ISPs fairly useless

In reply to a post by mikebear:

I've just read this item in today's Sophos newsletter :-

https://nakedsecurity.sophos.com/2014/11/18/naked-se...

What do members think.?

Google at some point are going to start ranking domains higher if they use HTTPs.
Link: http://googlewebmastercentral.blogspot.co.uk/2014/08...

The problem I foresee, is that each secure certificate will require its own dedicated IP address. For a long time now, shared hosting providers have been �sharing� 1 IPv4 address with many web-sites, in order to conserve usage.

If everyone now wants to go HTTPs, some hosting providers are going to have issues.

SNI (Server Name Indication) takes care of that.
https://en.wikipedia.org/wiki/Server_Name_Indication

Although personally I'd prefer to see a hurry up on IPv6 adoption.