我为什么要使用 ssl？
我正在运行一个约会网站，目前没有使用 SSL。
我注意到像 facebook 和 twitter 这样的主要网站不使用 https 进行登录，而只是使用普通的旧 http，https-ing 我的网站真的有什么优势吗？或者它仅用于抄送交易等等？
提前致谢。
I'm running a dating site and not using SSL at the moment.
I've noticed major sites like facebook and twitter do not use https for login but just use plain old http, is there really any advantage to https-ing my site or it is only for cc transactions or so ?
thanks in advance.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
实际上，Facebook 确实使用 https 进行登录：
Twitter 也是如此：
您会注意到他们在显示登录表单的页面上不使用 https。那是因为没有必要。
但是，如果可以的话，最好使用 ssl 登录本身，因为很多用户对所有站点都使用相同的密码。
我希望看到更多站点采用一种解决方案，即使用 OpenID/OAuth 进行登录，而不需要用户名/密码。
Actually, facebook does use https for its login:
as does twitter:
You'll notice they don't use https for the page that displays the signin form. That's because it isn't necessary.
However, it's a good idea to use ssl the login itself if you can, if only because so many users employ the same password for all sites.
One solution, which I'd like to see more sites employ, is using OpenID/OAuth for login instead of requiring a username/password.
SSL 对浏览器和服务器之间的流量进行加密。因此，几乎任何您想要保证安全的东西都需要进行 ssl 加密。谷歌搜索甚至这样做了，这样人们的搜索词就不会被拦截。
这只是您想要安全的情况，如果您网站的某些部分不安全，就会让想要的客户望而却步。我认为约会网站上有很多个人人口统计信息，有些人可能希望保护这些信息……只是我的 2 美分。
SSL encrypts the traffic between the browser and the server. So virtaully anything you want to be secure needs to be ssl'ed. Google search is even doing it so poeople can't have their search terms intercepted.
Its just the case of what YOU want secure, and if not having certain parts of your site secure will keep wanted customers away. I would think a dating site has a lot of personal demographics information that some people might want secure... just my 2 cents.
SSL 仅在浏览器和服务器之间传输敏感数据时使用。像facebook、twitter这样的大网站使用http就可以了（只要数据不敏感）。大多数网站的登录页面都使用 SSL。支付网关还使用 SSL 通过线路安全地传输支付信息。
顺便说一句，http 并不是“普通的旧”，https 也不是新趋势:)
SSL is used only when transmitting sensitive data between browser and server. It's fine for major sites like facebook and twitter to use http (as long as the data is not sensitive). Most website use SSL for their login page. SSL also used by payment gateway to safely transfer payment information through the wire.
And by the way, http is not "plain old" and https is not new trend either :)
如果您的用户提供任何敏感数据，ssl 可防止其被第三方拦截。如果您不使用 SSL，您应该假设某个第三方可以看到您的每个用户在您的网站上所做的一切。如果您对他们看到此信息感到满意，则将其保留为纯 http，但如果您不喜欢这种想法，请使用 https。
ssl 的另一个好处是它允许使用严格传输安全，这不仅在所有站点活动上强制使用 https，而且还可以防止中间人向用户欺骗您的站点，让他们认为他们正在访问您的站点。详细信息请参见：http://en.wikipedia.org/wiki/Strict_Transport_Security
If your users are providing any sensitive data, ssl prevents it from being intercepted by a third party. If you don't use SSL, you should assume that some third party can see everything that every one of your users does on your website. If you are comfortable with them seeing this information, then keep it plain http, but if you don't like that thought, go https.
Another benefit of ssl is that it allows the use of Strict Transport Security, which not only forces https on all site activity, but also prevents a man in the middle from spoofing your site to a user and making them think they are accessing your site. Details here: http://en.wikipedia.org/wiki/Strict_Transport_Security
我在一家大型 ISP 工作，并且很迷恋你们的一位在线会员。通过嗅探你的数据包，我可以找出她与另一个成员会面的时间和地点，重写数据包以更改位置，这样另一个人就不会出现，然后采取行动。
您决定您的用户是否可以接受。
I work at a major ISP and am infatuated with one of your online members. By sniffing your packets, I can find out when and where she's meeting another member, rewrite the packet to change the location so the other guy doesn't show up, and then make my move.
You decide whether that's acceptable to your users.
https 对于保护凭证（用户/密码）很有用，但它会增加网络负载并需要更多 CPU 资源（加密）。因此，通常仅用于身份验证。
https，带有服务器证书，再次保护网络钓鱼。
银行使用端到端应用程序
Https is useful to protect the credential (user/password) , but it increases the network load and requires more CPU resource (encryption). Thus, it is common to use only for authentication.
Https ,with server certificate protects again phising.
Banks uses end to end application