[look_lookatme]

This a naive question, but what would prevent Google from buying one of the trusted CAs (or fast tracking their own service into most browsers) and knocking the bottom out of the cert market with a free and easy SSL solution?

It doesn't make much business sense, but it fits in with some of Google's more philanthropic initiatives for a healthier net.

[cobbal]

As I understand it, certificates are not the only problem. SSL requires significantly more overhead on the server as well, which is why it is commonly used just for logins.

[eli]

The overhead of running your webserver itself of SSL isn't that huge a deal. But it usually means you also need to load all images and static assets off a HTTPS server, which makes things a bit more complicated than just throwing them on a cheap CDN. And, of course, using HTTPS means you skip any caching proxies that are between you and the user.

[mayanklahiri]

There was a good discussion about it on stack overflow: http://stackoverflow.com/questions/548029/how-much-overhead-...

The bottom line is that with keep-alive connections, the overhead should be less of a problem, since the only expensive part is the initial RSA key generation.