Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite
1

I would like to know if one should use 'HTTPS everywhere' extension? is it secure to use it? Are there any better alternatives?

HTTPS Everywhere is a Firefox and Chrome extension that encrypts your communications with many major websites, making your browsing more secure. Encrypt the web: Install HTTPS Everywhere today.

share|improve this question
1  
This seems a bit vague to me. In what sense do you want us to determine HTTPS Everywhere to be secure? What measure might qualify any alternatives to be "better"? – Iszi Jun 26 '12 at 16:29

migrated from webapps.stackexchange.com Jun 25 '12 at 11:19

4 Answers

up vote 5 down vote accepted

EFF is a highly respected organization dedicated to protecting privacy in electronic communications. It would be against their interests to jeopardize people's privacy through their products.

share|improve this answer
+1 EFF are a highly ethical and respected organisation and you should trust them. – Mark Hillick Jun 26 '12 at 8:36
Their ethic may not be questionable, but what about their competence? – curiousguy Jun 26 '12 at 20:00
up vote 3 down vote

You can also use NoScript to ensure your connections are over https. NoScript also comes with a tonne of other defences that include XSS protection, Clickjacking detection, ABE (kinda like a firewall in your browser) and many more. NoScript has been around for years and it's highly regarded and respected.

share|improve this answer
NoScript has HTTPS enforcement on selected domains, but does it have URL rewriting? – curiousguy Jun 26 '12 at 9:06
Not afaik, it forces the connection to use https as you say. I don't believe it ensures a HTTPS connection as well as the EFF solution but it is an alternative :) – Mark Hillick Jun 26 '12 at 9:22
up vote 2 down vote

As I replied before, you should understand that you can still use SSLstrip against HTTPS Everywhere. By searching a bit, I also came across this link and this test (related to the previous link), it seems that HTTPSEverywhere does not protect you against spoofing attacks. Related to this topic, I could also find this one which contains a lot of good information, and this one on how to protect from sslstrip attacks.

Have fun reading ;)

share|improve this answer
up vote 0 down vote

HTTPS Everywhere is a great feature but the issue I see is that it have dependency on the user browser and type of browser. Moreover if will be really tough to manage mobile and tablets browser.

It will be ideal if we handle HTTPS enforcement from your server itself. If you are hosting a very confidential portal, then you can go for secure session for all the pages (servlets etc) else you can enforce them on particular pages as well. I think we are bound to ensure the transport layer security when ever it is required from the server side itself. Hence pages where login/authenticate or confidential user data is displayed should be protected using HTTPS and the calling the link using HTTP should be denied by the server.

Sometimes it makes a sense not to enforce secure session for all pages or data for example images, as the session overhead will consume more bandwidth both for client and server.

As far security of HTTPS Everywhere is concerned, It could be secured but than you can't rely on its behavior and properties for security enforcement. Both ways you need to ensure that confidential pages or authentication pages have to go through HTTPS channel which is enforced from your server.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.