3 ms·

HTTPS Everywhere (client side option) is great. HTTPS only (server side option) is not.

• naf77 6y ago
  HTTPS only is a "Fail Closed" system, ie it blocks access in case of failure. This is safe for the general population. HTTPS/HTTP mixed support is a "Fail Open" system, ie it allows (unencrypted) access in case of failure. This is unsafe for the general population, see QUANTUM (above).
  • superkuh 6y ago
    You can argue for wearing a bulletproof vest at home if you're an iraqi nuclear scientist. But for most people it doesn't make sense and does more harm than good. In the same way, HTTPs only, *requiring* a system that "fails open", is bad for the general population. HTTP+HTTPS, yes, definitely. HTTPS only, no, only for sites and contexts where the rigid security is justified.
    • patmorgan23 6y ago
      Yes context is key. Its ok for wikipedia to fail back to HTTP but not for bank.