My understanding is that HTTPS Everywhere redirects websites to an https:// version if they support it.
My question is, if websites do have an https:// supported version why aren't they using them in the first place?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Suppose you're using a very old browser that cannot connect to the server using TLS, because the server does not support the old TLS versions and/or deprecated TLS cipher suites that the browser supports. For example, IE6 in WinXP supports at best SSLv3 + 3DES, and IE8 on WinXP supports at best TLS 1.0 + 3DES. SSLv3 is insecure because the CBC padding is non-deterministic and not covered by the MAC , and 3DES is not very secure (insecure?) because its block size is 64 bits . Many servers don't support any TLS version and ciphersuite that would let Internet Explorer on Windows XP (with all the patches applied) to connect, for example to at least download a newer browser.
If you're on such a browser, and the website implemented a mandatory redirect from http to https URLs, you would be SOL.
Another reason is that some sites are under the mistaken, anachronistic, impression that encryption is computationally expensive and their server's performance would be severely degraded by spending CPU cycles on crypto, and so they use TLS "when necessary" (login page, checkout page) and don't use TLS "when not necessary" (browsing the product catalog), to "improve site performance".
Part of the reason to use the
HTTPS Everywhere add-on is that sites that support
https by default may still accept
http connections and immediately redirect the user to the
https site (one reason to do this is so that old links will continue to work, more-or-less transparently). If you are sending sensitive information that is hidden by
https, such as a cookie or URL, that information would get exposed when you make your first connection over
http. So the
HTTPS Everywhere extension can protect you from accidentally leaking information when you click on old bookmarks or links to the
http version of a site.
Probably for legacy performance reasons and to allow easier integration with third party providers (e.g. advertising networks).
This very site loads from Google using plain HTTP as default. However, if you run HTTPS everywhere, it can load fully over HTTPS.
Some sites only have certain areas load over HTTPS by default (e.g. checkout process). HTTPS Everywhere will force the rest of the site load over HTTPS too, offering greater security, but there may be mixed content warnings.