> many website operators do not implement them I don't think that a site must do anything for HTTPS Everywhere to work, since it is (or should be) entirely cli

> many website operators do not implement them I don't think that a site must do anything for HTTPS Everywhere to work, since it is (or should be) entirely client-side. Obviously, if you had to fetch something over HTTP before switching to HTTPS then a proxy could slip you forged info. So, I don't know if Tor Browser works this way, but—just don't allow plain HTTP unless explicitly requested by the user? (Instead of requiring to specify HTTPS.) Weird if TB doesn't do this.