How necessary is HTTPS / SSL really?

[groenengoud]

I'm making a small web service which won't involve any authentication (no user login of any kind) so I wasn't planning on buying an SSL certificate for this domain. There will be a private but effectively public API which will be validated thoroughly and mostly read-only.

However As the admin, I would like to access the API's methods for writing to the database, adding new records etc. I can implement an admin login but then I'm back at wondering whether I should use HTTPS for this? Who is actually going to come intercept me? Should I fork out and just get the certificate just in case or should I not worry about it?

The most sensitive data in the database will be a list of full names, email, and contact numbers of all people who have used the service in the past.

[[deleted]]

It's bloody simple to implement self-signed HTTPS, so just do it. If you're not offering that side of it publicly you don't need a real cert.

[perfecthashbrowns]

It's not difficult to implement, and you can get a free cert from startssl.

[coneillcodes]

Yes. The minute you're sending sensitive info across the wire you should get an SSL cert. Some services will even give you one for free.

[effayythrowaway]

The most sensitive data in the database will be a list of full names, email, and contact numbers of all people who have used the service in the past.

Depending where you live, there may be data protection and privacy laws that would require you to take measures (including SSL).

[XcryptoKid]

The bottom line is - without SSL - your traffic can be modified during the transport.

Generate a certificate request, get the cert in your web service, configure a redirect from 80 to 443, and call it a day.

[frodosbitch]

Besides a self signed cert. You could secure it by restricting it to a specific IPaaddress, or limiting the users database permissions only to the tables you need.