8 ms·

This is very misleading, because it's overwhelmingly skewed toward large websites run by Google, Facebook, etc. The statistic is that 50% of page loads are HTT

This is very misleading, because it's overwhelmingly skewed toward large websites run by Google, Facebook, etc. The statistic is that 50% of page loads are HTTPS - the majority of those page loads are going to be visits to a very small subset of extremely popular (and well-resourced) sites, so this stat gives no indication that the remaining 50% is or will move to HTTPS anytime soon. The real tipping point will be 50% of unique domains visited being HTTPS. And a more interesting statistic would where that figure is now, and trend data on that. I wonder can that stat be extracted from public Mozilla data...

curt15 10y ago
In particular, it would be interesting to see what is the adoption rate in China, whose govt makes no secret of inspecting everyone's internet traffic.
- kavok 10y ago
  If you control the network infrastructure it is possible to inspect the traffic while still allowing https/SSL. https://www.a10networks.com/resources/glossary/ssl-decryption-encryption-and-inspection https://www.a10networks.com/resources/glossary/ssl-decryptio...
  - pedrocr 10y ago
    Only if you control the endpoints or have a compromised CA. The whole point of TLS is that you can't inspect traffic even if you own all the cables and routers between the two endpoints.
    - kavok 10y ago
      If I recall correctly all you have to do is deploy a cert on the client machine. The client connects to the machine doing the inspection and then it handles the final request under the real cert. They do this in corporate networks sometimes.
    - a-priori 10y ago
      The way this works is that the nation state installs a proxy that does a man-in-the-middle attack on the HTTPS traffic. It receives the incoming TLS handshake from the endpoint, and completes it with a certificate rooted in a 'compromised CA'. Then they handshake with the real server, and proxy the traffic. This allows them to intercept the traffic by shunting the plaintext off of the proxy to another system. Of course, it's plainly obvious to you, the endpoint, that this is going on because have to trust that compromised CA on your device to access the site. They'll, of course, helpfully offer instructions about how to do this and require it to be pre-installed on systems. But if there's no other way to access any HTTPS services? Lots of people will do it.
pc86 10y ago
It's not misleading because it's mentioned right in the article. The point is that there is more secure data than non-secure data being transmitted.
- lucideer 10y ago
  I just meant calling this a tipping point is misleading. It uses that statistic to paint a picture that's not representative of the reality. The first line of the article: > HTTPS adoption has now reached the moment of critical mass where it's gathering enough momentum that it will very shortly become "the norm" rather than the exception This statistic doesn't logically follow through to that conclusion in any way. I am hopeful that HTTPS is becoming the norm, but this particular stat just doesn't really give any insight either way.
  - swsieber 10y ago
    You could define the "norm" in one of two ways though - the user experience norm, and the server setup norm. If a user sees HTTPS most of the time (seeing the lock in the URL bar, even if just from a few large sights), then that is their norm - they'd expect that all sights would do that.
    - lucideer 10y ago
      Maybe, but - despite the constant back and forth by the tech community about the minutiae of address bar security indicator UX - nobody really notices whether they're on a HTTP or HTTPS site. The new warnings for password fields are a promising step however.
bryanlarsen 10y ago
Another tipping point is [1]: Chrome and Firefox now say "not secure" when password and credit card fields are displayed on a plan HTTP page. That's going to push a lot of sites to switch over. 1: https://blog.chromium.org/2016/09/moving-towards-more-secure-web.html https://blog.chromium.org/2016/09/moving-towards-more-secure...
- riffraff 10y ago
  google will also penalise sites with such fields without https in their search results, which is possibly an even more important thing for site owners.
  - mattnewton 10y ago
    Or they will engineer even less secure password-hiding fields. At least it breaks password managers.
- hashhar 10y ago
  Firefox Nightly has been saying that for almost over 8 months now. I think there were issues regarding the "too many warnings make people blind" stance. But I'm happy it finally made it into release.
saywatnow 10y ago
What this is, is another accidental slide down the slope towards centralisation of the web. Yes, it's easy for a techie to add a letsencrypt cert, but browsing with https-by-default I still hit a lot of sites that lack https - mostly the sort that run with practically zero maintenance for a non-technical business or community. Browsers are going to show scary warnings for these (indistinguishable to the average user from any other warning), and then stop loading them altogether, and the sites will die only to be reborn (if at all) on facebook.
- lucideer 10y ago
  The problem there though is not in allowing non-techies to easily install certs, but rather in incentivising cheap hosting companies to provide it by default, with zero configuration. Many companies are already doing this, but they're still in a minority. Making HTTPS "the norm" is hopefully the road to making this an expected feature from those hosts.
- CharlesW 10y ago
  > What this is, is another accidental slide down the slope towards centralisation of the web. Sorry, can you explain? (Not playing "gotcha", I really don't understand.)
  - euyyn 10y ago
    He means "a small number of websites by big players" vs "a big number of websites by modest people".
- brennen 10y ago
  I'm broadly in favor of HTTPS-everywhere, but this does seem likely to happen in a number of cases. Then again, I'm not sure it will be all that impactful in a situation where everybody's already leaving the open web for Facebook anyway...
- Filligree 10y ago
  That's still an improvement. Security is important, and I would prefer to not see sites which are insecure by default, even if it means losing some small minority of sites. Going forwards I expect we'll see more webservers with Let's Encrypt-by-default, so it's a limited-time problem; it shouldn't affect many people after the initial shakeout. On NixOS, enabling LE is no harder than putting "services.nginx.virtualHosts.<hostname>.enableACME = true" in my configuration file.
billyhoffman 10y ago
We are getting closer. A few months back, I pulled the Alexa Top 1M: Of those, ~550K had port 443 open and were speaking HTTPS. Of those, ~270K had valid certificates (not expired, not self signed, matching hostnames, etc). Planning to do a follow up to get a trend. Also some deeper analysis is needed: Many of the HTTPS sites just 301/301 to HTTP for the same domain, and often to other domains. So while those are websites that speak HTTPS, they aren't really HTTPS sites.
- lucideer 10y ago
  It's slightly better but taking the top 1M is still kind of the opposite of what we're looking for stats wise. I wonder what percentage of the Alexa Bottom 100M are on 443. The long tail is still going to be large in cumulative terms

curt15 10y ago

In particular, it would be interesting to see what is the adoption rate in China, whose govt makes no secret of inspecting everyone's internet traffic.

kavok 10y ago
If you control the network infrastructure it is possible to inspect the traffic while still allowing https/SSL. https://www.a10networks.com/resources/glossary/ssl-decryption-encryption-and-inspection https://www.a10networks.com/resources/glossary/ssl-decryptio...
- pedrocr 10y ago
  Only if you control the endpoints or have a compromised CA. The whole point of TLS is that you can't inspect traffic even if you own all the cables and routers between the two endpoints.
  - kavok 10y ago
    If I recall correctly all you have to do is deploy a cert on the client machine. The client connects to the machine doing the inspection and then it handles the final request under the real cert. They do this in corporate networks sometimes.
  - a-priori 10y ago
    The way this works is that the nation state installs a proxy that does a man-in-the-middle attack on the HTTPS traffic. It receives the incoming TLS handshake from the endpoint, and completes it with a certificate rooted in a 'compromised CA'. Then they handshake with the real server, and proxy the traffic. This allows them to intercept the traffic by shunting the plaintext off of the proxy to another system. Of course, it's plainly obvious to you, the endpoint, that this is going on because have to trust that compromised CA on your device to access the site. They'll, of course, helpfully offer instructions about how to do this and require it to be pre-installed on systems. But if there's no other way to access any HTTPS services? Lots of people will do it.

pc86 10y ago

It's not misleading because it's mentioned right in the article. The point is that there is more secure data than non-secure data being transmitted.

lucideer 10y ago
I just meant calling this a tipping point is misleading. It uses that statistic to paint a picture that's not representative of the reality. The first line of the article: > HTTPS adoption has now reached the moment of critical mass where it's gathering enough momentum that it will very shortly become "the norm" rather than the exception This statistic doesn't logically follow through to that conclusion in any way. I am hopeful that HTTPS is becoming the norm, but this particular stat just doesn't really give any insight either way.
- swsieber 10y ago
  You could define the "norm" in one of two ways though - the user experience norm, and the server setup norm. If a user sees HTTPS most of the time (seeing the lock in the URL bar, even if just from a few large sights), then that is their norm - they'd expect that all sights would do that.
  - lucideer 10y ago
    Maybe, but - despite the constant back and forth by the tech community about the minutiae of address bar security indicator UX - nobody really notices whether they're on a HTTP or HTTPS site. The new warnings for password fields are a promising step however.

bryanlarsen 10y ago

Another tipping point is [1]: Chrome and Firefox now say "not secure" when password and credit card fields are displayed on a plan HTTP page. That's going to push a lot of sites to switch over. 1: https://blog.chromium.org/2016/09/moving-towards-more-secure-web.html https://blog.chromium.org/2016/09/moving-towards-more-secure...

riffraff 10y ago
google will also penalise sites with such fields without https in their search results, which is possibly an even more important thing for site owners.
- mattnewton 10y ago
  Or they will engineer even less secure password-hiding fields. At least it breaks password managers.
hashhar 10y ago
Firefox Nightly has been saying that for almost over 8 months now. I think there were issues regarding the "too many warnings make people blind" stance. But I'm happy it finally made it into release.

saywatnow 10y ago

What this is, is another accidental slide down the slope towards centralisation of the web. Yes, it's easy for a techie to add a letsencrypt cert, but browsing with https-by-default I still hit a lot of sites that lack https - mostly the sort that run with practically zero maintenance for a non-technical business or community. Browsers are going to show scary warnings for these (indistinguishable to the average user from any other warning), and then stop loading them altogether, and the sites will die only to be reborn (if at all) on facebook.

lucideer 10y ago
The problem there though is not in allowing non-techies to easily install certs, but rather in incentivising cheap hosting companies to provide it by default, with zero configuration. Many companies are already doing this, but they're still in a minority. Making HTTPS "the norm" is hopefully the road to making this an expected feature from those hosts.
CharlesW 10y ago
> What this is, is another accidental slide down the slope towards centralisation of the web. Sorry, can you explain? (Not playing "gotcha", I really don't understand.)
- euyyn 10y ago
  He means "a small number of websites by big players" vs "a big number of websites by modest people".
brennen 10y ago
I'm broadly in favor of HTTPS-everywhere, but this does seem likely to happen in a number of cases. Then again, I'm not sure it will be all that impactful in a situation where everybody's already leaving the open web for Facebook anyway...
Filligree 10y ago
That's still an improvement. Security is important, and I would prefer to not see sites which are insecure by default, even if it means losing some small minority of sites. Going forwards I expect we'll see more webservers with Let's Encrypt-by-default, so it's a limited-time problem; it shouldn't affect many people after the initial shakeout. On NixOS, enabling LE is no harder than putting "services.nginx.virtualHosts.<hostname>.enableACME = true" in my configuration file.

billyhoffman 10y ago

We are getting closer. A few months back, I pulled the Alexa Top 1M: Of those, ~550K had port 443 open and were speaking HTTPS. Of those, ~270K had valid certificates (not expired, not self signed, matching hostnames, etc). Planning to do a follow up to get a trend. Also some deeper analysis is needed: Many of the HTTPS sites just 301/301 to HTTP for the same domain, and often to other domains. So while those are websites that speak HTTPS, they aren't really HTTPS sites.

lucideer 10y ago
It's slightly better but taking the top 1M is still kind of the opposite of what we're looking for stats wise. I wonder what percentage of the Alexa Bottom 100M are on 443. The long tail is still going to be large in cumulative terms