Why use HTTPS Everywhere instead of going to the HTTPS site directly?

Question

My understanding is that HTTPS Everywhere redirects websites to an https:// version if they support it.

My question is, if websites do have an https:// supported version why aren't they using them in the first place?

Answer 1

Suppose you're using a very old browser that cannot connect to the server using TLS, because the server does not support the old TLS versions and/or deprecated TLS cipher suites that the browser supports. For example, IE6 in WinXP supports at best SSLv3 + 3DES, and IE8 on WinXP supports at best TLS 1.0 + 3DES. SSLv3 is insecure because the CBC padding is non-deterministic and not covered by the MAC [1], and 3DES is not very secure (insecure?) because its block size is 64 bits [2]. Many servers don't support any TLS version and ciphersuite that would let Internet Explorer on Windows XP (with all the patches applied) to connect, for example to at least download a newer browser.

If you're on such a browser, and the website implemented a mandatory redirect from http to https URLs, you would be SOL.

Another reason is that some sites are under the mistaken, anachronistic, impression that encryption is computationally expensive and their server's performance would be severely degraded by spending CPU cycles on crypto, and so they use TLS "when necessary" (login page, checkout page) and don't use TLS "when not necessary" (browsing the product catalog), to "improve site performance".

Some sites were built and deployed some time ago and have not been updated in a few years. At the time, people were less aware of the total surveillance situation and the issue of authenticity and data integrity. Basically they thought that if confidentiality is not important, TLS is not needed, and thus bad people can inject bad javascript into sites and viruses into executables as they are being downloaded, with impunity.

1 - https://www.openssl.org/~bodo/ssl-poodle.pdf

2 - https://sweet32.info/

Answer 2

Part of the reason to use the HTTPS Everywhere add-on is that sites that support https by default may still accept http connections and immediately redirect the user to the https site (one reason to do this is so that old links will continue to work, more-or-less transparently). If you are sending sensitive information that is hidden by https, such as a cookie or URL, that information would get exposed when you make your first connection over http. So the HTTPS Everywhere extension can protect you from accidentally leaking information when you click on old bookmarks or links to the http version of a site.

Answer 3

Probably for legacy performance reasons and to allow easier integration with third party providers (e.g. advertising networks).

This very site loads from Google using plain HTTP as default. However, if you run HTTPS everywhere, it can load fully over HTTPS.

Some sites only have certain areas load over HTTPS by default (e.g. checkout process). HTTPS Everywhere will force the rest of the site load over HTTPS too, offering greater security, but there may be mixed content warnings.