1

My understanding is that HTTPS Everywhere redirects websites to an https:// version if they support it.

My question is, if websites do have an https:// supported version why aren't they using them in the first place?

  • @grochmal You are confused. HTTP will not be dropped from either Chrome or FF but will have functionalities deprecated from HTTP. For example, things like Geolocation and other sensitive functionalities. HTTP itself is not going anywhere nor outright deprecation were ever put on their road maps. blog.mozilla.org/security/2015/04/30/… – Bacon Brad Oct 10 '16 at 23:44
  • @baconface - very good point, thanks. Killed the misleading comment. – grochmal Oct 11 '16 at 13:00
2

Suppose you're using a very old browser that cannot connect to the server using TLS, because the server does not support the old TLS versions and/or deprecated TLS cipher suites that the browser supports. For example, IE6 in WinXP supports at best SSLv3 + 3DES, and IE8 on WinXP supports at best TLS 1.0 + 3DES. SSLv3 is insecure because the CBC padding is non-deterministic and not covered by the MAC [1], and 3DES is not very secure (insecure?) because its block size is 64 bits [2]. Many servers don't support any TLS version and ciphersuite that would let Internet Explorer on Windows XP (with all the patches applied) to connect, for example to at least download a newer browser.

If you're on such a browser, and the website implemented a mandatory redirect from http to https URLs, you would be SOL.

Another reason is that some sites are under the mistaken, anachronistic, impression that encryption is computationally expensive and their server's performance would be severely degraded by spending CPU cycles on crypto, and so they use TLS "when necessary" (login page, checkout page) and don't use TLS "when not necessary" (browsing the product catalog), to "improve site performance".

Some sites were built and deployed some time ago and have not been updated in a few years. At the time, people were less aware of the total surveillance situation and the issue of authenticity and data integrity. Basically they thought that if confidentiality is not important, TLS is not needed, and thus bad people can inject bad javascript into sites and viruses into executables as they are being downloaded, with impunity.

1 - https://www.openssl.org/~bodo/ssl-poodle.pdf

2 - https://sweet32.info/

  • Thanks Z.T. Unfortunately what you describe is far to technical for me to understand. Is there somewhere a less technical user can go to better understand how HTTPSEverywhere works? – Kol12 Oct 11 '16 at 0:15
  • @Kol12 Sites that support https don't always use https for a few reasons: 1) old links/bookmarks (thanks @drewbenn). 2) very old browsers would be incompatible. 3) it creates more work for the server. 4) it makes the page load to take longer. 5) nobody explained to them why https is important, so they didn't think they needed to do it. – Z.T. Oct 11 '16 at 0:26
  • Plus unless you are one of those few government agencies with huge piles of money to spend on 'custom' support, XP hasn't gotten security patches for over two years and probably everything on it is totally pwned by now. – dave_thompson_085 Oct 11 '16 at 5:59
  • @Z.T So a lot of websites do have https capability but don't offer it by default? How are you meant to know if httpseverywhere has secured an https connection to a site? What are stable rules? It looks to me like they are domains that are linked to the site your on and the sites that httpsEW will attempt to force encryption on? – Kol12 Oct 11 '16 at 8:59
  • @Kol12 yes, you replace http with https and see if anything breaks, yes. – Z.T. Oct 12 '16 at 20:39
2

Part of the reason to use the HTTPS Everywhere add-on is that sites that support https by default may still accept http connections and immediately redirect the user to the https site (one reason to do this is so that old links will continue to work, more-or-less transparently). If you are sending sensitive information that is hidden by https, such as a cookie or URL, that information would get exposed when you make your first connection over http. So the HTTPS Everywhere extension can protect you from accidentally leaking information when you click on old bookmarks or links to the http version of a site.

0

Probably for legacy performance reasons and to allow easier integration with third party providers (e.g. advertising networks).

This very site loads from Google using plain HTTP as default. However, if you run HTTPS everywhere, it can load fully over HTTPS.

Some sites only have certain areas load over HTTPS by default (e.g. checkout process). HTTPS Everywhere will force the rest of the site load over HTTPS too, offering greater security, but there may be mixed content warnings.

  • If we don't see https and the lock icon on websites does that mean HTTPS – Kol12 Oct 13 '16 at 5:10
  • Everywhere isn't working? – Kol12 Oct 13 '16 at 5:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.