10 Years of HTTPS Everywhere – EFF

Its been 10 years since the beta release of EFFs HTTPS Everywhere web browser extension. It encrypts your communications with websites, making your browsing more secure. HTTPS has journeyed its way from an urgent recommendation to a main component of traffic of our everyday web experience. In 2018, we discussed the importance of HTTPS Everywhere and our ongoing effort to encrypt the web. We have come far and still have more work to do. This post gives a snapshot into the landscape of HTTPS Everywhere today.

Since the launch of HTTPS Everywhere, other projects have also taken on the task of helping users browse securely. These more recent projects include DuckDuckGos Smarter Encryption and Smart HTTPS. The biggest difference is that HTTPS Everywhere still operates a community-curated list of rules for particular sites. Many users who add to our list have intimate knowledge of the sites they are contributing. Examples of such reports include subdomains of a site that have misconfigurations, insecure cookies, or CDN buckets to account for.

Many users wanted dynamic upgrades to HTTPS, so we developed the Encrypt All Sites Eligible (E.A.S.E) mode in HTTPS Everywhere.

EASE automatically attempts to upgrade connections from insecure HTTP to secure HTTPS for all sites, and prevents unencrypted connections from being made. This parallels the features of the more recent projects listed. EASE mode also assists in preventing downgrade attacks, where malicious actors attempt to redirect your browser to an insecure HTTP connection to the site. This is handled slightly differently by other projects, but we want to emphasize that our rulesets also apply to sub resources on the page as well. Meaning, if there are images and scripts that link to another domain, such as a Content Delivery Network (CDN), our rules can apply to those as well. We are not only adding rulesets, but amending them as websites change. HTTPS Everywheres maintainers and contributors have done a fantastic job over the years maintaining this aspect of the project.

A common question is whether HTTPS Everywhere is still helpful if DNS over HTTPS (DoH) is enabled? Absolutely. The Domain Name System (DNS) looks up a sites IP address when you type the sites name into your browser. A DNS request occurs before the sites server connection is made; DoH occurs at this layer. After the DNS request has been made, the connection to the sites server is next. That is where HTTPS Everywhere comes in: it is able to secure your traffic to the requested site.

DNS request = request for I.P. sites address

HTTP request = request communication with site's server/website content

DoH & HTTPS = encrypted request for sites I.P. & encrypted request with site's server/website content respectively

Many browsers have made important strides in adopting HTTPS at a more aggressive rate. For example:

We hope to see these developments, especially the option to be HTTPS by default, in both Firefox and Chrome.

In the coming decade, we hope browsers will further help to encrypt the web. Its time for browsers to close these remaining gaps and give users the choice to upgrade to HTTPS. We hope our HTTPS Everywhere project will eventually not be needed in its current state, because the browsers themselves will close these gaps. This will take a strong commitment by all major browsers to provide comprehensive HTTPS options for their users.

In addition to encrypting your web traffic, HTTPS Everywhere also provides extended features that have made way for some exciting developments in internet privacy.

Our update channels provide a secure way for other parties to load their own rulesets. For example, SecureDrop partnered with Tor to use HTTPS Everywhere Update channels to have human-readable onions in Tor Browser! As SecureDrop explains:

SecureDrop uses onion servicesaccessible only via the Tor networkto protect sources sending tips to news organizations. When you visit an onion service (address ends with .onion), all traffic to and from the service is encrypted and anonymized.

We are excited to be able to provide a platform for easily shared AND secure tips to newsrooms. A very big hat tip to SecureDrop and Tor Browser.

HTTPS Everywheres ruleset rewrites are very useful, but can be memory heavy in comparison to most extensions. To alleviate this, we have a ruleset redirect engine written in Rust that compiles to Web Assembly. If Web Assembly isnt supported, then Javascript is the fallback for rewrites. We picked Rust because it is a memory safe language that is lightweight and manageable. Also, one need not rewrite existing parts of the code base in order to take part in more modern developments of web applications.

Learn more about Rust + Web Assembly: https://rustwasm.github.io/docs/book/introduction.html

This project and its extended features were created to make privacy and security not only accessible but easily obtainable to everyone. Anonymity and privacy on the web shouldnt be limited to people with highly technical knowledge. Hopefully when we write an update a decade from now, HTTPS Everywhere will be retired, because its encryption safeguards will have been fully integrated as a common feature of the net.

Thank you for using HTTPS Everywhere. If you havent installed it, do so today!

Read more here:
10 Years of HTTPS Everywhere - EFF