Why don't we see more HTTPS? Is CPU an issue?
adamt: Why though - would anyone want to browser a site like news.ycombinator.com over SSL?  The vast majority of web data is public data so encryption is of little value, and due to the way SSL works, then there's arguably little value in SSL for authentication (if someone can hack the site, they can  generally apply/install for a new SSL cert easily enough). In terms of privacy, SSL gains little - given that SSL breaks Host based virtual hosting, then accessing dodgysite.com's IP address lets a man in the middle know (almost) as much as about your browsing habits as accessing the site without SSL.In terms of downside, SSL adds latency (ignore CPU time for now, it adds a further 2+ RTT times for the CLIENT_HELLO and SERVER_HELLO + cipher negotiation/key exchange on connection. Breaks (until SNI becomes about) HTTP Host based virtual servers. Breaks any web-caching by a proxy, and in many cases by the browser (most browsers don't use their disk cache for SSL content).All that downside, for what upside?  Yes - for the few forms where someone submits passwords or other private data, yes. But why on earth would you want to use SSL otherwise?