5 ms·

Awesome! Any idea how much of that is attributable to LetsEncrypt and HTTPSEverywhere?

tomschlick 7y ago
It's probably more attributed to browsers marking non-https as 'Not Secure' than anything but LetsEncrypt definitely has had a substantial impact to make that change possible.
- SteveNuts 7y ago
  Also Google mentioned they would begin ranking HTTPS sites higher.
  - StartupTree 7y ago
    That was always a false duck.
- SlowRobotAhead 7y ago
  Pretty much this. I ran into a local store taking credit cards awhile back, no TLS, weird, so I go to the store owner in person. I explain the problem and he insists that can't be the case, he's mad at me. "See! It's got a lock on the website!"... on the homepage. I direct him to the store and now it says Not Secure. That did more to explain the situation than my attempt at TLS and HTTPS and Certs. He was able to call his web guy and say "It says not secure, Jerry! Fix it". It was such a simple addition to (at least in Firefox) use the words Not Secure that it's crazy no one thought of it before.
  - JoshTriplett 7y ago
    If that doesn't work, there's also the argument that "credit card providers require it, and could stop you from taking credit cards until you fix it".
    - SlowRobotAhead 7y ago
      You're right, but didn't have to. This guy when he could get past being mad at me knew that was against the rules. Also even if it was allowed, no one wants to shop at a place that says Not Secure. Side topic, but I've been trying to explain to our terrible CFO for years that PCI / PCI DSS is a real thing. He thinks that's the type of regulation that only giant companies have to deal with.
      - toomuchtodo 7y ago
        Feel free to report your org to your merchant processor if necessary if you're not meeting compliance requirements and think you can get away with it without compromising yourself.
      - icedchai 7y ago
        Even if it says "secure", that doesn't mean it really is. I worked at a place in the 90's that hosted a some sites taking credit cards through HTTPS. You know what they did? They sent emails, in clear text, to people at the store that would enter / process the cards manually.
    - paulddraper 7y ago
      Even scalier than PCI compliance mumbo jumbo is customers not giving you any money.
    - Avery3R 7y ago
      this is what gave us the pay.reddit.com loophole back when reddit https was for people with gold only
  - clairity 7y ago
    did you check the url the form submits to for https? it was a somewhat common pattern once upon a time to load the form in http but submit it in https. not great, but better than nothing (nobody should do this nowadays btw).
    - SlowRobotAhead 7y ago
      I did it. And it wasn't. Doesn't matter though, the reality for him was that customers saw a Not Secure and that was a problem. All the crypto, certs, forms, probability of issue, technical things didn't matter, just the perception.
- JoshTriplett 7y ago
  > It's probably more attributed to browsers marking non-https as 'Not Secure' Browsers couldn't have done that if https wasn't free and simple for servers.
  - mr_woozy 7y ago
    Never thought I'd see a world where that was the reality, nice to appreciate really.
- patrickmcnamara 7y ago
  I don't think any of my personal websites be HTTPS without LetsEncrypt. It's great for that use case.
zamadatix 7y ago
There was a link a month or two back that showed Let's Encrypt is used by 30% of domains but if this is by volume of data not domain share then it'd be a lot less than 30%.
mikece 7y ago
Is a LetsEncrypt certificate "just as secure" as other certs? I have to imagine the answer is "no" simply because LetsEncrypt is free and the other certs aren't -- what more do you get by paying for a cert?
- a13n 7y ago
  It is just as secure, you get nothing more by paying.
  - deaps 7y ago
    So for my personal projects, I use lets encrypt. As far as I know (and I could be wrong now, haven't checked in a while) - their certs are only good for 3 months. Which is simple enough to get around - run a script on your box that updates the cert every 90 days automatically. At work, we use a paid certificate that is good for a longer period of time (normally a year). So that's one benefit to paying, I suppose. As far as encryption technologies and security, the traffic encrypted by a lets encrypt cert is just as secure as the traffic secured by a paid-for CA signed cert.
    - sadfklsjlkjwt 7y ago
      Usually you set up auto-renewal with lets encrypt. Easier than remembering to renew every year.
    - anewaccountaday 7y ago
      They have a built in command for their 'certbot' cli now that you can use to have your certificates update automatically. (It's been a bit sinse I went through it but I think it may be as simple as a extra flag in the command to generate the inital cert)
    - taftster 7y ago
      The fact that Let's Encrypt certificates expire quickly is a feature, not anything to do with paid vs. non-paid. Let's Encrypt could have just as easily generated certificates good for a year or more. But the point of Let's Encrypt is to force you to do this in an automated way, using scripts like you suggest. You're not getting around anything. The choice was by design. https://letsencrypt.org/2015/11/09/why-90-days.html https://letsencrypt.org/2015/11/09/why-90-days.html
gator-io 7y ago
The whole reason we started tracking HTTPS vs HTTP was because of LetsEncrypt. Love that they broke the need to pay ridiculously overpriced fees to generate certs.
amyjess 7y ago
I'd imagine that a lot of this is attributable to Firesheep calling attention to how anyone on a public Wi-Fi network could snoop on your Facebook traffic. Most of the major websites fast-tracked HTTPS shortly after that.
- cdine 7y ago
  Thanks! That was the goal. For those who aren't familiar, the original slides and our response blog posts are still up: https://codebutler.com/projects/firesheep/ https://codebutler.com/projects/firesheep/
intolerabletech 7y ago
It is amazing how HTTPSEverywhere has revealed how incompetent people are regarding TLS/SSL. I can't count the number of times I've seen the extension page during sign-ups or logins. Oracle Cloud just triggered it the other day during signup and initial login. Most times when I email, asking why an email marketing link, or an embedded token-login email link sends me through an HTTP URL, the person on the other ends tells me they don't know and that's unexpected, or a result of out-sourcing their marketing/email/whatever. In one case, their marketing mail provider supposedly just blanket intercepted all links and unknown-to-their-customers passed them through an HTTP redirect. Stunningly unprofessional.

It's probably more attributed to browsers marking non-https as 'Not Secure' than anything but LetsEncrypt definitely has had a substantial impact to make that change possible.

SteveNuts 7y ago
Also Google mentioned they would begin ranking HTTPS sites higher.
- StartupTree 7y ago
  That was always a false duck.
SlowRobotAhead 7y ago
Pretty much this. I ran into a local store taking credit cards awhile back, no TLS, weird, so I go to the store owner in person. I explain the problem and he insists that can't be the case, he's mad at me. "See! It's got a lock on the website!"... on the homepage. I direct him to the store and now it says Not Secure. That did more to explain the situation than my attempt at TLS and HTTPS and Certs. He was able to call his web guy and say "It says not secure, Jerry! Fix it". It was such a simple addition to (at least in Firefox) use the words Not Secure that it's crazy no one thought of it before.
- JoshTriplett 7y ago
  If that doesn't work, there's also the argument that "credit card providers require it, and could stop you from taking credit cards until you fix it".
  - SlowRobotAhead 7y ago
    You're right, but didn't have to. This guy when he could get past being mad at me knew that was against the rules. Also even if it was allowed, no one wants to shop at a place that says Not Secure. Side topic, but I've been trying to explain to our terrible CFO for years that PCI / PCI DSS is a real thing. He thinks that's the type of regulation that only giant companies have to deal with.
    - toomuchtodo 7y ago
      Feel free to report your org to your merchant processor if necessary if you're not meeting compliance requirements and think you can get away with it without compromising yourself.
    - icedchai 7y ago
      Even if it says "secure", that doesn't mean it really is. I worked at a place in the 90's that hosted a some sites taking credit cards through HTTPS. You know what they did? They sent emails, in clear text, to people at the store that would enter / process the cards manually.
  - paulddraper 7y ago
    Even scalier than PCI compliance mumbo jumbo is customers not giving you any money.
  - Avery3R 7y ago
    this is what gave us the pay.reddit.com loophole back when reddit https was for people with gold only
- clairity 7y ago
  did you check the url the form submits to for https? it was a somewhat common pattern once upon a time to load the form in http but submit it in https. not great, but better than nothing (nobody should do this nowadays btw).
  - SlowRobotAhead 7y ago
    I did it. And it wasn't. Doesn't matter though, the reality for him was that customers saw a Not Secure and that was a problem. All the crypto, certs, forms, probability of issue, technical things didn't matter, just the perception.
JoshTriplett 7y ago
> It's probably more attributed to browsers marking non-https as 'Not Secure' Browsers couldn't have done that if https wasn't free and simple for servers.
- mr_woozy 7y ago
  Never thought I'd see a world where that was the reality, nice to appreciate really.
patrickmcnamara 7y ago
I don't think any of my personal websites be HTTPS without LetsEncrypt. It's great for that use case.

zamadatix 7y ago

There was a link a month or two back that showed Let's Encrypt is used by 30% of domains but if this is by volume of data not domain share then it'd be a lot less than 30%.

mikece 7y ago

Is a LetsEncrypt certificate "just as secure" as other certs? I have to imagine the answer is "no" simply because LetsEncrypt is free and the other certs aren't -- what more do you get by paying for a cert?

a13n 7y ago
It is just as secure, you get nothing more by paying.
- deaps 7y ago
  So for my personal projects, I use lets encrypt. As far as I know (and I could be wrong now, haven't checked in a while) - their certs are only good for 3 months. Which is simple enough to get around - run a script on your box that updates the cert every 90 days automatically. At work, we use a paid certificate that is good for a longer period of time (normally a year). So that's one benefit to paying, I suppose. As far as encryption technologies and security, the traffic encrypted by a lets encrypt cert is just as secure as the traffic secured by a paid-for CA signed cert.
  - sadfklsjlkjwt 7y ago
    Usually you set up auto-renewal with lets encrypt. Easier than remembering to renew every year.
  - anewaccountaday 7y ago
    They have a built in command for their 'certbot' cli now that you can use to have your certificates update automatically. (It's been a bit sinse I went through it but I think it may be as simple as a extra flag in the command to generate the inital cert)
  - taftster 7y ago
    The fact that Let's Encrypt certificates expire quickly is a feature, not anything to do with paid vs. non-paid. Let's Encrypt could have just as easily generated certificates good for a year or more. But the point of Let's Encrypt is to force you to do this in an automated way, using scripts like you suggest. You're not getting around anything. The choice was by design. https://letsencrypt.org/2015/11/09/why-90-days.html https://letsencrypt.org/2015/11/09/why-90-days.html

gator-io 7y ago

The whole reason we started tracking HTTPS vs HTTP was because of LetsEncrypt. Love that they broke the need to pay ridiculously overpriced fees to generate certs.

amyjess 7y ago

I'd imagine that a lot of this is attributable to Firesheep calling attention to how anyone on a public Wi-Fi network could snoop on your Facebook traffic. Most of the major websites fast-tracked HTTPS shortly after that.

cdine 7y ago
Thanks! That was the goal. For those who aren't familiar, the original slides and our response blog posts are still up: https://codebutler.com/projects/firesheep/ https://codebutler.com/projects/firesheep/

intolerabletech 7y ago

It is amazing how HTTPSEverywhere has revealed how incompetent people are regarding TLS/SSL. I can't count the number of times I've seen the extension page during sign-ups or logins. Oracle Cloud just triggered it the other day during signup and initial login. Most times when I email, asking why an email marketing link, or an embedded token-login email link sends me through an HTTP URL, the person on the other ends tells me they don't know and that's unexpected, or a result of out-sourcing their marketing/email/whatever. In one case, their marketing mail provider supposedly just blanket intercepted all links and unknown-to-their-customers passed them through an HTTP redirect. Stunningly unprofessional.