HTTPS Everywhere is a "soft enforcement" of HTTPS, with hand-curated regex that switches you to HTTPS if it's known by the EFF where the appropriate HTTPS serve

HTTPS Everywhere is a "soft enforcement" of HTTPS, with hand-curated regex that switches you to HTTPS if it's known by the EFF where the appropriate HTTPS server is. It's a wonderful, wonderful tool and I'd feel naked without it, but it "fails open" as it were - if something doesn't have https support, or the https support is buggy, it just shows you the http version. I believe HTTP Nowhere is similar to HTTPS Everywhere, but it "fails closed" - if there isn't an HTTPS version of a site, HTTP Nowhere just doesn't show you that site. I really hope we one day get to a world where it's feasible to have HTTP Nowhere on by default. There are a shocking number of sites which don't support HTTPS, probably because they are suffering some misapprehension about the overhead it adds. Amazon does a bizarre thing where they bounce you back and forth between HTTP and HTTPS depending on how much information about you that they feel a page reveals. It's quite an unstable situation for such a high value target. I wouldn't be surprised if there are a number of spearphishing and MITM attacks that take advantage of Amazon's cavalier attitude towards its customers' safety and privacy.