Ethernet module with HTTPS support

[I14R10]

I've been playing with ethernet modules and sending some data on my server via HTTP POST request from my STM32F103 board. I'm currently using USR K6 module communicating via UART with AT commands. And it works. I borrowed it to my friend, who is a security freak, and he told me his home server only exclusively accepts HTTPS and of course, my little gadget doesn't work for him. He also said he doesn't want to accept plain HTTP since it's a security hazard.

Now, he is always overreacting in regard of internet security. His passwords are kilometer long passwords...
What worries me is that he told me that internet hosting companies will soon begin to stop supporting plain HTTP and that my module won't work on my website anymore. Is that true? I've asked my web hosting company but their response always takes days.

Second question is: for IoT, is HTTP instead HTTPS really that bad? From what I've read most of IoT doesn't support HTTPS because of their memory and processing power. Is it really worth to raise cost and complexity 5 times only to support HTTPS?

Third question: I found only one ethernet module which supports HTTPS and it's this one https://www.eztcp.com/en/products/cse-m53g, which is sold on only 2 web pages on the internet and it costs about 40-45 euros, which is about 5 times what my current module costa and about 20 times what my other module W5500 costs. Is there any good and cheaper solution for implementing HTTPS in my embedded product?

 

[betwixt]

HTTP vs. HTTPS depends upon the security risk of your IoT network. If you are only using local WiFi to communicate between devices it probably isn't worth the extra overhead but if you are going more 'global' and the data you carry is confidential it is more important.

The difference between the two is in the encoding/decoding of the data, this is usually done in software so you might be able to use a HTTP module and your own routines to make it HTTPS compatible.

Brian.

 

[I14R10]

I obviously have a lot of reading to do, but maybe you can help me clarify couple things.

When I ask for a web page, or if I want to send data to a web server, I use GET and POST requests.

In HTTP text inside GET and POST requests is not encoded, just plain text.

In HTTPS the text inside GET and POST is encoded but everything else stays the same? Is that all there is for HTTPS?

(By "everything else" I mean, the way of opening sockets, opening ports etc... all those things that need to be done to open a connection and send data). Or is HTTPS completely different protocol then HTTP?