boblord (boblord) wrote,

SSL: Excuses, excuses, excuses

When I ask people why they don't use SSL on the login page, I get a answers that can be boiled down to "SSL is too expensive". When I dig deeper, I find more complexity than I expected.


First, let me address the issue of raw SSL performance. There was a time when it was simply too expensive to contemplate SSL for very many tasks. SSL operations were performed on the same CPU that was used to perform database lookups, generate HTML, and a variety of other functions. The expensive RSA private key operations caused a significant drain on the servers.

But things are different now. Web farm architectures are far more sophisticated than they were in 1997. And between Moore's Law and performance tuning in the SSL libraries (like the open source NSS crypto libraries) we now see very high performance number for SSL connections, even in software. We were recently doing some performance tests for a project, and while we had all the measurement tools fired up, we decided to see how many SSL-based logins we could get per second. On a $5,000 Dell box, we were able to get about 1,000 logins per second, which translates to 3,600,000 logins per hour. Depending on how we defined "login" (the ratio of RSA handshakes to SSL restarts), we could hit 5,000,000 logins per hour. Assuming you want a little breathing room for peak loads, you could throw another $5,000 box into the mix. Or toss in 10 and spread them around the country. Or you could buy SSL accelerators (either PCI cards, or as front-end balancers), though I doubt they are necessary these days given these numbers for software-based SSL.

The other complaint which I used to hear in 1998, but have not heard in the past several years, is that modems cannot compress SSL sessions, which means that customers on modems will see worse performance on an HTTPS page than they will on an HTTP page. That fact remains (you can't dramatically compress properly encrypted data) but given the slide in modem usage, this is less and less of a problem over time. And now that AOL is raising rates on modem users, that trend will accelerate.

Bottom line: In 2006, SSL is super cheap. You have to plan for SSL performance, but it's not going to be a major task compared to the complexity of the rest of the web farm architectures that exist out there. And it's not going to cost much at all. For companies that are worth billions of dollars, I think they can easily find room for a few $5,000 boxes to improve security.


Knowing that, why do companies still not deploy SSL as widely as they should? That's the second, and more surprising part of the story. The reality is that these companies are segmented into divisions, each of which has its own goals, budgets, and problems. There's often a "login team" that is responsible for providing a single-sign-on scheme so that other divisions don't have to manage their own account/password databases and cookie-passing scheme. Then there's the team that deals with the front page. Then there's the team that deals with the primary service (banking, trading, mail, or whatever their core app is). Then there are groups that deal with the aftermath of fraud, like phishing.

These divisions are not connected as cleanly as they might be. There is little incentive for the login team, for example, to help the Front Page team use SSL correctly. They are there to provide SSL when you hit the "Login" submit button and that's what they do. Meanwhile the Front Page team believes that they cannot afford to put SSL on their portion of the site on their own. And the fraud team's main charter is to help customers who have been victimized, not to stop the problem in the first place.

Every survey since 1492 about computer security and the Internet has shown that CEOs, politicians, consumers, and dogs believe that "Security is the #1 issue facing us today". And yet, as far as I can see, there is a real failure of leadership at the senior-most levels of these companies to connect the dots and to put SSL on every page. This is especially true of the financial companies.

And the terrible part is that it's the consumers who pick of the tab of phishing attacks, not just in dollars, but in time and stress as well.

It's 2006 and there is every reason for a company in the financial world to implement a coherent site security strategy that involves SSL on every page. Wells Fargo did it! SSL is cheap, security expertise is widely available, and customers are under attack on a daily basis.
Tags: nss, phishing, security, ssl

  • SSL session cookies vulnerable (SSL everywhere!)

    Elinor Mills' CNET's post titled Google making SSL changes, other sites quiet is interesting not just because it's about session cookies at some…

  • Counterintelligence at the USDA?

    I just read the Department of Homeland Security's "Foreign Travel Threat Assessment: Electronic Communications Vulnerabilities". Bottom line, they…

  • Banks still act like phishers

    A few years ago I started writing about how financial institutions, organizations that are really security companies at their core, have implemented…

Comments for this post were disabled by the author