如果您不进行金融交易，是否值得使用 https？
嘿，我想向那里的专家提一个简单的问题。我有一个网站，允许用户通过消息进行交互，注册时只需输入用户名和密码，验证您的年龄，然后可以选择添加电子邮件。我想确实没有任何敏感信息。值得使用https吗？它会阻止会话劫持并会影响性能吗？
Hey just a quick question for any experts out there. I have a site that lets users interact through messages and to sign up you just make a username and password, verify your age, and optionally, add an email. There isn't really any sensitive information I suppose. Is it worth using https. Will it prevent session hi jacking and will it hinder performance?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
我以前也考虑过这个问题。我认为当用户登录或更改信息时您会需要安全连接。
I've thought about this before as well. I would think you would want a secure connection when users are logging in or changing information.
不过，对于某些人来说，密码和年龄会被视为敏感信息。您准备好与一些可能与您持不同观点的人打交道了吗？
For some people, passwords and age would be considered sensitive information, though. Are you prepared to deal with some people who may have a different view than you?
每当您使用用户名/密码时，您绝对应该使用 HTTPS 来保护整个会话的安全。与用户密码泄露所造成的潜在成本相比，您的成本相当小。研究 始终表明人们在访问的几乎每个系统上都使用相同的密码。
此外，除了密码暴露的风险之外，还应考虑您的网站是一种通信工具。被冒充会给您的用户带来哪些潜在风险或伤害？是否有人以他们的身份发送恶意消息？
只是不值得冒这个风险。至少确保运输安全。
Anytime you use a username/password you should absolutely secure the entire session with HTTPS. The cost to you is fairly minor compared to the potential cost to your users if their passwords are exposed. Research consistently shows that people use the same password for nearly every system they access.
Additionally, beyond the risk of password exposure, consider that your site is a communications tool. What's the potential risk or harm to your users of being impersonated? Of having malicious messages sent under their identity?
It's just not worth the risk. Secure the transport at the very least.
我认为一旦您进行了某种登录处理，您就应该保护用户的密码。您可以通过 https 或使用 http 摘要身份验证来执行此操作。
我的加密要点是，相当多的用户在您的网站上使用的密码与他们的银行帐户或类似帐户的密码相同。尽管您站点上的信息不敏感，但密码确实可以保护重要的内容。
I think that as soon as you have some kind of login handling you should protect the password of the user. You can do that either through https or by using http digest authentication.
My main point for encryption is that quite a lot of your users will have the same password to your site as they have to their bank account or something similar. Even though the information at your site is not sensitive, the passwords may indeed protect something important.
是的，需要 SSL/TLS 来维护经过安全验证的会话。如果您有登录信息，则登录信息和整个会话必须受 https 保护。即使您有一个简单的 Web 应用程序，将所有流量转发到 https 也更容易、更安全。
问题是如果您使用 http，会话 ID (cookie) 可能会被泄露。如果该会话经过身份验证，则黑客可以使用该会话 ID 向服务器进行身份验证，而无需用户名和密码。
这是 OWASP Top 10 A3 的明确要求：“破坏的身份验证和会话管理”
http://www.owasp.org/images/0/0f/ OWASP_T10_-_2010_rc1.pdf
通过 http 发送 cookie 也违反了 CWE -614 和 CWE-311。
Yes, SSL/TLS is required to maintain a securely authenticated session. If you have a login, then the login's post and THE ENTIRE SESSION must be protected by https. It is easier and more secure to forward all traffic to https, even if you have a simple web application.
The problem is that a session id (cookie) can be leaked if you use http. If that session is authenticated then a hacker can use that session id to authenticate with the server without a username and password.
This is clear requirement of The OWASP top 10 A3: "Broken Authentication and Session Management"
http://www.owasp.org/images/0/0f/OWASP_T10_-_2010_rc1.pdf
Sending a cookie over http is also a violation of CWE-614 and CWE-311.
如果您传输密码和电子邮件地址或任何其他私人或个人身份信息，那么至少这是值得的。如果存在任何非 HTTPS 通信，则可能会发生会话劫持，但这是许多网站愿意接受的风险，具体取决于您的情况。
性能问题取决于您的硬件和堆栈，但 HTTPS 与 HTTP 相比会对性能造成“一些”影响。这还不足以阻止您保护密码和敏感的用户信息。
It is worth it at the very least if you transmit passwords and email addresses, or any other private or personally identifiable information. Session hijacking is possible if there's any non-HTTPS communication, but that's a risk many websites are willing to accept, and depends on your situation.
Performance issues depend on your hardware and your stack, but there will be "some" performance hit from HTTPS vs HTTP. It's not enough to stop you from protecting passwords and sensitive user information.