HTTPS does not prevent:

Disclaimers

• Traffic / content analysis
  • ​Study of 100,000 web pages: easy to ID activity [PDF]
  • Dynamic web pages reveal distinct traffic patterns [PDF]
  • Malware's Use of TLS and Encryption
  • Classifying encrypted traffic with TLS-aware telemetry
  • Hunting Threat Actors With TLS Certificates
  • My Experience With the Great Firewall of China
• Browser / client fingerprinting
  • ​Browser fingerprinting using HSTS supercookies
  • Browser fingerprinting using HPKP & HSTS cache  [PDF]
  • TLS fingerprinting with FingerPrinTLS
  • Analyzing HTTPS Traffic to ID OS, Browser, & App [PDF]

Disclaimers

HTTPS does not prevent:

• Rogue or Compromised Certificate Authorities
  • Google's Certificate Transparency project
    • ​2011: DigiNotar caught issuing fraudulent certs
    • 2012: Trustwave sells root signing capability
    • 2015: Symantec misissued cert for ‘google.com’
    • 2016: Submariner: withdrawn & not-yet trusted certs

Disclaimers

• Phishing
  • Certs do not guarantee safe, honest, or legit content
  • Netcraft complains: phishing sites use free certs
  • Let's Encrypt responds: anti-phishing is not CA's role  

HTTPS does not prevent:

Disclaimers

• Client or server compromise 
  • Seek professional help
     
• De-Anonymization 
  • Seek professional help

HTTPS does not prevent:

Reasons to prefer HTTP

...that aren't really reasons for actual website owners

Reasons to prefer HTTP

You’re from 2006 and you love Upside-Down-Ternet

​"My neighbors are stealing my wireless internet access.  I could encrypt it or alternately I could have fun."

Reasons to prefer HTTP

You are an ISP and want to sell out, annoy, and/or track customers as they move across the web

Reasons to prefer HTTP

You are an ISP and want to sell out, annoy, and/or track customers as they move across the web

Reasons to prefer HTTP

• 2008:  Charter and other ISPs tested DPI to sell targeted ads 
• 2013:  CMA Communications injects ads via JavaScript
• 2014:  Company markets “Wi-Fi monetization strategies” to help ISPs “capitalize on JavaScript-injected ad campaigns…”

• 2015:  Verizon, AT&T, Vodaphone and others inject tracking IDs into all mobile browsing by their customers  [1, 2, 3, 4]

  • ​Test your mobile provider:  lessonslearned.org/sniff
• 2016:  Chinese ISPs inject ads and malware

You are an ISP and want to sell out, annoy, and/or track customers as they move across the web

Reasons to prefer HTTP

You are SIGINT and you want an easy way to inject code or track individuals

Reasons to prefer HTTP

You are a frumpy government and you want to block only  some pages of a website

Reasons to prefer HTTP

You engage in BGP attacks for fun, profit, or malice

Reasons to prefer HTTP

You retain the web traffic you carry... just in case

Reasons to prefer HTTP

Mandatory / regulatory traffic inspection

• Healthcare, Education, Enterprise, Mil, Gov
  • Install private root certs to selectively decrypt
  • Invasive end-point monitoring (keylogging)
  • Aggressive traffic analysis
  • Block entire domains
  • Forced adaptation

...that just aren't that strong of a reason anymore

Reasons to not use HTTPS

Reasons to not use HTTPS

Encryption decreases server performance

• IsTLSFastYet.com
• Have you actually tested your system?

TLS requires a dedicated IP address

• Server Name Identification
• Encypted SNI: Threat Model Analysis

Excuse:

Rebuttal:

Excuse:

Rebuttal:

Reasons to not use HTTPS

Certificates cost money

• Free:  LetsEncrypt.org
  • 20+ million active certificates​
  • 10+ million domains

Excuse:

Rebuttal:

• Free:  Amazon AWS
• Free:  Symantec
• Free:  StartSSL.com
   
• $16:  SSLMate.com

Reasons to not use HTTPS

• Google:  AdSense ad code support for SSL
• IAB:  We messed up - try our new encrypted ads!
• Mozilla:  Proposed Principles for Content Blocking
   
• Perhaps it's time to reconsider the web ad model
  • Ad-blocker use is steadily increasing
  • ​Mobile webpage data = 50% ads 
  • Online ad economy is full of click fraud
  • Malvertising is rampant - 2015, 2015, 2016

Can't serve lucrative relevant useful ads

Excuse:

Rebuttal:

Reasons to not use HTTPS

• Easily check a site to see what's missing or wrong:
  • Industry standard:  SSL Labs
  • Lots of extra info:  High-Tech Bridge
  • OK:  Symantec​
  • OK:  Comodo
  • OK:  DigiCert
     
• ​Check your HTTP headers - SecurityHeaders.io

Configuration and management are too hard

Excuse:

Rebuttal:

Reasons to not use HTTPS

• Automatic configuration is built in
  • LetsEncrypt - how it works
  • SSLMate - features
  • Caddyserver - automatic HTTPS

• CDNs, registrars, and webhosts offer support
  • Dreamhost
  • Akamai
  • List of web hosts that do & do not support using certs from Let's Encrypt

Configuration and management are too hard

Excuse:

Rebuttal:

Reasons to not use HTTPS

Mozilla provides an extensive guide​​

Configuration and management are too hard

Excuse:

Rebuttal:

Reasons to not use HTTPS

HTTPS errors produce confusing warnings

Excuse:

Reasons to not use HTTPS

Chrome '15:  Improving SSL Warnings - PDF; video

Excuse:

Rebuttal:

HTTPS errors produce confusing warnings

Reasons to not use HTTPS

Chrome '15:  ​​Simplifying the Page Security Icon

Excuse:

Rebuttal:

HTTPS errors produce confusing warnings

Reasons to not use HTTPS

Chrome '16:  ​Rethinking Connection Security Indicators

Excuse:

Rebuttal:

HTTPS errors produce confusing warnings

Reasons to not use HTTPS

View your browser's warnings:

BadSSL.com

Excuse:

Rebuttal:

HTTPS errors produce confusing warnings

Reasons to not use HTTPS

Seek professional help and/or change jobs

Indifference

Excuse:

Rebuttal:

Reasons to enable HTTPS

...that are very good reasons if you are a conscientious website owner

Reasons to enable HTTPS

 The whole principle is wrong; it's like demanding that grown men live on skim milk because the baby can't eat steak.  -  Robert A. Heinlein
 

 The Net interprets censorship as damage and routes around it.  -  John Gilmore
 

 Censorship reflects a society's lack of confidence in itself. It is a hallmark of an authoritarian regime.  -  Potter Stewart

Censorship sucks

Reasons to enable HTTPS

Reduce unsanctioned tracking

• W3C TAG: Unsanctioned tracking is harmful
  • "...unsanctioned tracking is actively harmful to the Web, because it is not under the control of users and not transparent."​

• Other entities can track injected trackers

Reasons to enable HTTPS

Matthew Green comments on AT&T + NSA collaboration:

The network is hostile

IETF RFC 1122:  In general, it is best to assume that the network is filled with malevolent entities that will send in packets designed to have the worst possible effect.

Reasons to enable HTTPS

​Tor nodes should be assumed to be dangerous

• 2014:  Exposing Malicious Tor Exit Relays
• 2014:  Malware inserted into downloaded binaries
• 2016:  Malicious hidden services directories

The network is hostile

Alec Muffet asks:  Do you love your users?

Reasons to enable HTTPS

Firefox & Chrome are moving away from HTTP

• Mozilla is deprecating HTTP
  • Deprecating non-secure HTTP
  • FAQs for Deprecating non-secure HTTP [PDF]
  • We're Deprecating HTTP and it's going to be OK
     
• Chromium Security will prefer secure origins for powerful features and is following through on their proposal to mark HTTP as non-secure!
   
• IE / Edge, Safari, Opera, others - no statement yet

Reasons to enable HTTPS

Firefox & Chrome are moving away from HTTP

Recently announced by Google:

Reasons to enable HTTPS

HSTS helps force HTTPS connections

• HTTP Strict Transport Security
  • Header sent by server after TLS connection is made
  • Browser caches the instruction to only connect via HTTPS for a defined time period, usually a year
  • Slow adoption - 95% of servers are missing HSTS
     
• HSTS preloading is relatively easy for Chrome
  • ​HTTP -> HTTPS redirect happens in the browser
  • HSTS Preload List: State of the Union 2016

Reasons to enable HTTPS

You provide sensitive information

AIDS.gov leaked identifying information of visitors over HTTP

Reasons to enable HTTPS

You provide sensitive information

• Content that deserves a higher level of privacy and security:
  • Domestic violence
  • Sexual abuse
  • Suicide help
  • Mental health
  • Symptoms about any medical condition
    • Health sites data mine visitor activity
  • A wide range of personal and social issues that
    have the potential to be stigmatizing

Reasons to enable HTTPS

You provide sensitive information

• Content that deserves a higher level of privacy and security:
  • Politics, activism, protesting, dissent
  • Whistleblower reporting and protections
    • ​Tips to 29 federal agencies are not confidential
  • Any flavor of legal help or law firm
  • News and media outlets
    • After Snowden, Why Aren't News Orgs Using HTTPS?
  • Banking and financial institutions
  • Security research - whitepapers, tools, binaries

Reasons to enable HTTPS

You collect sensitive information

• Login - username and password
  
  
• Contact Us - forms that request customer info
  
  
• File upload - images, video, PDFs, résumés
  
  
• Geolocation - address, ZIP code

Reasons to enable HTTPS

You collect sensitive information

Every Step You Fake: A Comparative Analysis of Fitness Tracker Privacy and Security

Reasons to enable HTTPS

Everyone is doing it

Internet & web standards bodies

• May '14  - IETF RFC 7258: Pervasive Monitoring Is an Attack
• Nov '14  -  IAB:  Statement on Internet Confidentiality
• Jan '15  -  W3C TAG: Securing the Web
• Mar '15  -  IAB: The Need for HTTPS
• July '15  -  W3C TAG: End-to-End Encryption and the Web
• Oct '15  -  W3C: Upgrade Insecure Requests
• Oct '15  - Internet Society sponsors Lets Encrypt
• Oct '15  -  IAB:  We messed up

Reasons to enable HTTPS

Everyone is doing it

Major websites switch to HTTPS

• 2010:  Gmail
• 2011:  Facebook
• 2012:  Twitter
• 2013:  Apple App Store, Google Search
• 2014:  Yahoo Mail, GitHub Pages
• 2014:  Google says HTTPS is an SEO ranking signal
• 2015:  Wikipedia, Netflix, Reddit, Google Blogspot, The Washington Post
• 2016:  Tumblr, Wordpress, Buzzfeed, Wired, Amazon, BBC, iOS apps, The Guardian, many more

Reasons to enable HTTPS

Everyone is doing it

News outlets
 

•   NY Times:                  privacy    security   content authenticity
   
•   Washington Post:    privacy   security   anti-censorship
             
•   JustSecurity.org:      privacy   security   content integrity
   
•   Lawfare.com:  block trackers   anti-censorship  content integrity
   
•   The Guardian:       privacy    security    content integrity    SEO

Reasons to enable HTTPS

OMB creates HTTPS-Only Standard

Tony Scott, Federal CIO, issues mandate for all Federal websites:

Full Memorandum  [PDF]

The HTTPS-Only Standard

Reasons to enable HTTPS

OMB creates HTTPS-Only Standard

Tony Scott, Federal CIO, issues mandate for all Federal websites:

Full Memorandum  [PDF]

The HTTPS-Only Standard

Reasons to enable HTTPS

...Empower USA's TLAs?    #patrioticbackfire

Stewart A. Baker, former NSA general counsel,

from the Risky Business podcast #412, starting at 51:25

     At lot of the reaction to Snowden was not wanting the U.S. in their communications.  But the first thing that Silicon Valley did was say 'we need more HTTPS, more TLS.'  And, ironically, that probably empowered U.S. intelligence, vis-a-vis the intelligence agencies and the law enforcement agencies of the rest of the world, more than any other technical development since international cables, because it meant that people who'd been getting communications between two Brazillians just by tapping their lines couldn't do it anymore because the communications were going straight back to Hotmail encrypted and the only way to get it was to get it at the server and that meant going hat-in-hand to the U.S. Government and saying 'could you help us investigate this crime.'

User requirements

Very easy!

• ​Mandatory:
  • Browsers and OS should auto-update
  • Test your browser:  HowsMySSL.com
     
• Recommended:
  • ​EFF’s HTTPS Everywhere
  • uBlock Origin​ to block advertising
  • Chrome: actively mark HTTP as insecure

User requirements

Very easy!  Probably not a good idea...

​Train them to avoid visiting HTTP sites...

     with electricity!
 

​The Web Training Collar:

The State of HTTPS?

SecureUtah.org

SecureUtah.org

Why Utah?

SecureUtah.org

Tracking HTTPS support of Utah websites

UtahWatch.org

Tracking HTTPS support of Utah websites

UtahWatch.org

Tracking HTTPS support of Utah websites

UtahWatch.org