> You claim the second most important reason for using HTTPS is my privacy, yet you share all pages I visit with Google analytics. I think that's a totally fai

> You claim the second most important reason for using HTTPS is my privacy, yet you share all pages I visit with Google analytics. I think that's a totally fair point. Our use of Google Analytics isn't changing any time soon, but we do plan to add a third-party disclosure page that makes it clear what third parties have some window into our visitors' browsing: https://github.com/18F/18f.gsa.gov/issues/293 https://github.com/18F/18f.gsa.gov/issues/293 This includes otherwise invisible things, like our host, Amazon, and (until we implement OCSP stapling, which is happening soon) our CA during revocation checking (in some browsers). FWIW, we do turn on the Google Analytics anonymization flag, which instructs Google to chop off the last IP triplet before they write the data into their database. Of course, that depends on trusting Google to keep their promise, but it's something.