computer science

HTTPS Everywhere

HTTPS Everywhere is a computer science topic covered in the lgStudy science library. This page brings together a partial reference excerpt, illustrations, worked examples, real-world applications and a short study plan, so you can understand HTTPS Everywhere rather than just read about it. In short: HTTPS Everywhere is a discontinued free and open-source browser extension for Google Chrome, Microsoft Edge, Mozilla Firefox, Opera, Brave, Vivaldi and Firefox for Android, which was developed collaboratively by The Tor Project and the Electronic Frontier Foundation (EFF). It automatically makes websites use a more secure HTTPS connection instead of HTTP, if they support it.

Key takeaways

HTTPS Everywhere belongs to computer science; place it in that map before memorising details.
Learn the definition first, then one example that makes the definition concrete.
Connect HTTPS Everywhere to a quantity you can measure, compute or draw — that is where exam questions come from.
Reproduce the core statement of HTTPS Everywhere from memory before moving on to harder problems.

Reference excerpt

HTTPS Everywhere is a discontinued free and open-source browser extension for Google Chrome, Microsoft Edge, Mozilla Firefox, Opera, Brave, Vivaldi and Firefox for Android, which was developed collaboratively by The Tor Project and the Electronic Frontier Foundation (EFF). It automatically makes websites use a more secure HTTPS connection instead of HTTP, if they support it. The option "Encrypt All Sites Eligible" makes it possible to block and unblock all non-HTTPS browser connections with one click. Due to the widespread adoption of HTTPS on the World Wide Web, and the integration of HTTPS-only mode on major browsers, the extension was retired in January 2023.

Development HTTPS Everywhere was inspired by Google's increased use of HTTPS and is designed to force the usage of HTTPS automatically whenever possible. The code, in part, is based on NoScript's HTTP Strict Transport Security implementation, but HTTPS Everywhere is intended to be simpler to use than No Script's forced HTTPS functionality which requires the user to manually add websites to a list. The EFF provides information for users on how to add HTTPS rulesets to HTTPS Everywhere, and information on which websites support HTTPS.

Platform support A public beta of HTTPS Everywhere for Firefox was released in 2010, and version 1.0 was released in 2011. A beta for Chrome was released in February 2012. In 2014, a version was released for Android phones.

SSL Observatory The SSL Observatory is a feature in HTTPS Everywhere introduced in version 2.0.1 which analyzes public key certificates to determine if certificate authorities have been compromised, and if the user is vulnerable to man-in-the-middle attacks. In 2013, the ICANN Security and Stability Advisory Committee (SSAC) noted that the data set used by the SSL Observatory often treated intermediate authorities as different entities, thus inflating the number of certificate authorities. The SSAC criticized SSL Observatory for potentially significantly undercounting internal name certificates, and noted that it used a data set from 2010.

Continual Ruleset Updates The update to Version 2018.4.3, shipped on 3 April 2018, introduces the "Continual Ruleset Updates" function. To apply up-to-date https-rules, this update function executes one rule-matching within 24 hours. A website called https-rulesets was built by the EFF for this purpose. This automated update function can be disabled in the add-on settings. Prior to the update- mechanism there have been ruleset-updates only through app-updates. Even after this feature was implemented there are still bundled rulesets shipped within app-updates.

Reception Two studies have recommended building HTTPS Everywhere functionality into Android browsers. In 2012, Eric Phetteplace described it as "perhaps the best response to Firesheep-style attacks available for any platform". In 2011, Vincent Toubiana and Vincent Verdot pointed out some drawbacks of the HTTPS Everywhere add-on, including that the list of services which support HTTPS needs maintaining, and that some services are redirected to HTTPS even though they are not yet available in HTTPS, not allowing the user of the extension to get to the service.

Legacy HTTPS Everywhere initiative inspired opportunistic encryption alternatives:

2022: Firefox for Android and Firefox Focus HTTPS-only mode 2021: Google Chrome HTTPS-only mode 2020: Firefox built-in HTTPS-only mode 2019: HTTPZ for Firefox / WebExt supporting browsers 2017: Smart-HTTPS (closed-source early since v0.2)

See also Transport Layer Security (TLS) – Cryptographic protocols that provide communications security over a computer network. Privacy Badger – A free browser extension created by the EFF that blocks advertisements and tracking cookies. Switzerland (software) – An open-source network monitoring utility developed by the EFF to monitor network traffic. Let's Encrypt – A free automated X.509 certificate authority designed to simplify the setup and maintenance of TLS encrypted secure websites. HTTP Strict Transport Security – A web security policy mechanism which helps to protect websites against protocol downgrade attacks and cookie hijacking.

References

Worked examples

Example 1 — a first encounter with HTTPS Everywhere

Start with the simplest possible case. Write down what HTTPS Everywhere claims or describes in one sentence, then invent the smallest concrete situation in which that sentence is true. In computer science, the smallest case is usually a single object, a single equation or a single measurement. Check that every symbol or term in your sentence has a meaning in that case.

Example 2 — changing one variable

Take the situation from Example 1 and change exactly one quantity: double it, halve it, or set it to zero. Predict what should happen to HTTPS Everywhere before you calculate. Comparing your prediction with the result is the fastest way to find out whether you understand the idea or only the words.

Example 3 — an exam-style question

Typical questions about HTTPS Everywhere ask you to (a) state it precisely, (b) apply it to given data, and (c) explain a limitation. Practise writing all three answers in under five minutes; the third part is what separates a full-mark answer from an average one.

Applications of HTTPS Everywhere

In research: HTTPS Everywhere appears in computer science research whenever the underlying quantities have to be modelled precisely. Papers usually cite it as a starting assumption and then explore where it breaks down.
In technology and industry: Engineering practice reuses HTTPS Everywhere in design rules, simulations and safety margins. Knowing the idea lets you read a specification sheet and understand why the numbers look the way they do.
In the classroom: HTTPS Everywhere is common in secondary-school and first-year university syllabi. It links to neighbouring topics Discontinued free Firefox WebExtensions, Electronic Frontier Foundation, Free software programmed in JavaScript, so understanding it makes those chapters shorter.
In everyday life: Look for HTTPS Everywhere outside the textbook — in sport, cooking, traffic, electronics or the sky above you. An example you found yourself is remembered far longer than one you were given.

Ask Teacher Smith questions about this articleOpens your AI tutor with a question about “HTTPS Everywhere” →

Affiliate

Preply — study more efficiently by working with a personal tutor. 50% off.

How to study HTTPS Everywhere in 20 minutes

Read the reference excerpt below once, without taking notes.
Close the page and write down what HTTPS Everywhere means in your own words.
Compare your version with the excerpt and mark what you missed.
Work through the three examples above with pen and paper.
Explain HTTPS Everywhere out loud to somebody else — or to Teacher Smith in the lgStudy chat.

Frequently asked questions

What is HTTPS Everywhere in simple terms?

Why does HTTPS Everywhere matter?

Because it connects several computer science ideas at once: it gives you a definition you can apply, a quantity you can calculate, and a way to check whether a result is plausible.

How should I study HTTPS Everywhere?

Read the excerpt, restate it from memory, then work through the examples and applications listed on this page. The five-step study plan above takes about twenty minutes.

What does this page cover?

It gives you a compact reference excerpt plus original lgStudy explanations, examples, applications and study material on HTTPS Everywhere.