While true, moving the entire web to HTTPS with PFS-enabled configurations, secure cipher suites, and key-pinning is a huge challenge. In any case, the strateg

While true, moving the entire web to HTTPS with PFS-enabled configurations, secure cipher suites, and key-pinning is a huge challenge. In any case, the strategy lately has been to force consumer ISPs to keep logs of who is connecting where (The UK government wants ISPs to log the URI of every plaintext page you visit, and will no doubt eventually want DNS logs and TLS SNI and TCP connection logs for other kinds of connectivity). The best you can do today is ensure your TLS deployment is A+ rated at SSL Labs[0] and offer a Tor hidden service for your visitors. That said, if governments and ISPs legislate/cooperate to do active MITM attacks, then there's nothing we can really do to help Joe Public that wouldn't constitute a crime or get you put on a watchlist yourself. [0] https://www.ssllabs.com/ssltest/ https://www.ssllabs.com/ssltest/