Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I would like to know if one should use 'HTTPS everywhere' extension? Is it secure to use it? Are there any better alternatives?

HTTPS Everywhere is a Firefox and Chrome extension that encrypts your communications with many major websites, making your browsing more secure. Encrypt the web: Install HTTPS Everywhere today.

share|improve this question

migrated from webapps.stackexchange.com Jun 25 '12 at 11:19

This question came from our site for power users of web applications.

1  
This seems a bit vague to me. In what sense do you want us to determine HTTPS Everywhere to be secure? What measure might qualify any alternatives to be "better"? –  Iszi Jun 26 '12 at 16:29
    
Does the extension really do anything in-and-of-itself besides redirecting from http://x to https://x where x matches some site from a provided list that has opt-in HTTPS? (I have no experience with the add-on, so no real clue) –  Nick T Nov 5 '13 at 18:50

5 Answers 5

up vote 8 down vote accepted

EFF is a highly respected organization dedicated to protecting privacy in electronic communications. It would be against their interests to jeopardize people's privacy through their products.

share|improve this answer
1  
+1 EFF are a highly ethical and respected organisation and you should trust them. –  Mark Hillick Jun 26 '12 at 8:36
1  
Their ethic may not be questionable, but what about their competence? –  curiousguy Jun 26 '12 at 20:00

You can also use NoScript to ensure your connections are over https. NoScript also comes with a tonne of other defences that include XSS protection, Clickjacking detection, ABE (kinda like a firewall in your browser) and many more. NoScript has been around for years and it's highly regarded and respected.

share|improve this answer
    
NoScript has HTTPS enforcement on selected domains, but does it have URL rewriting? –  curiousguy Jun 26 '12 at 9:06
    
Not afaik, it forces the connection to use https as you say. I don't believe it ensures a HTTPS connection as well as the EFF solution but it is an alternative :) –  Mark Hillick Jun 26 '12 at 9:22

As I replied before, you should understand that you can still use SSLstrip against HTTPS Everywhere. By searching a bit, I also came across this link and this test (related to the previous link), it seems that HTTPSEverywhere does not protect you against spoofing attacks. Related to this topic, I could also find this one which contains a lot of good information, and this one on how to protect from sslstrip attacks.

Have fun reading ;)

share|improve this answer

I think this extension is quite simple and generally safe to use for two reasons:

Firstly, on Q. When does HTTPS Everywhere protect me? When does it not protect me? section on HTTPS Everywhere website FAQ page

HTTPS Everywhere depends entirely on the security features of the individual web sites that you use; it activates those security features, but it can't create them if they don't already exist.

This means the extension simply turn on HTTPS automatically if possible and does not communicate between the user's browser and the website.

Secondly, it is open sourced and the source code is public. It means anyone can access and read how the extension works if possible.

However, in my opinion, the description of the extension seems misleading, because it claims to 'encrypts your communications' on their website. This extension simply switches from http to https if possible and doesn't do anything with the transmission of the data.

share|improve this answer
    
By switching from http to https, the communication (transport) is encrypted. What's misleading about that? –  Rob W Mar 24 at 9:48
    
@RobW I said misleading because what HTTP Everywhere does is turning on the encryption, but actually perform encryption. IMHO, their description I quoted in the answer can mislead people to understand the extension can encrypts if the website they are using doesn't support SSL. –  baxang 2 days ago

HTTPS Everywhere is a great feature but the issue I see is that it have dependency on the user browser and type of browser. Moreover if will be really tough to manage mobile and tablets browser.

It will be ideal if we handle HTTPS enforcement from your server itself. If you are hosting a very confidential portal, then you can go for secure session for all the pages (servlets etc) else you can enforce them on particular pages as well. I think we are bound to ensure the transport layer security when ever it is required from the server side itself. Hence pages where login/authenticate or confidential user data is displayed should be protected using HTTPS and the calling the link using HTTP should be denied by the server.

Sometimes it makes a sense not to enforce secure session for all pages or data for example images, as the session overhead will consume more bandwidth both for client and server.

As far security of HTTPS Everywhere is concerned, It could be secured but than you can't rely on its behavior and properties for security enforcement. Both ways you need to ensure that confidential pages or authentication pages have to go through HTTPS channel which is enforced from your server.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.