Just wondering if it’s a big deal to enable support for SSL?
Not asking to enforce SSL like some Distro forums, just make it optional… I know that it would put a measurable additional load on servers (which of course can be offloaded), but I kind of feel that everything on the Internet eventually should move towards more secure connections.
Of course, if someone didn’t want to pay for certificates IMO a self-signed certificate should do just fine… which would support encrypting connections but not verify the identify of the Server (The client would have to manually accept the unverifiable certificate).
In general, IMO everything on the Internet should be encrypted. For the better part of the past year I’ve been gravitating towards the belief that it’s too easy to profile people because of all the unencrypted things we do on the Internet.
The current non-SSL policy is only a step less critical than how Hotmail is architected… Since before Microsoft bought Hotmail, logins have been encrypted and everything else thereafter isn’t (although curiously through use of SSL-Anywhere it seems SSL is available, just not enforced by the code).
Although you don’t think that content should be private, who knows… particularly if people are using a public Hot Spot (publicly shared Internet connection). So, for instance currently participating in these Forums might at least in part reveal who I am in a publicly shared network which could lead to hacking probes based on my guessed identity. At the moment a hacker can sniff and collect content. That’s more immediate and automatic than picking out the SSL URL, figuring out which posts the URLs correspond to, then snaking the content.
Am I paranoid? Yeah. But I think it’s also keeping up with the times.