HTTPS Everywhere

From Wikipedia, the free encyclopedia
Jump to navigation Jump to search
HTTPS Everywhere
HTTPS Everywhere icon.svg
Developer(s)Electronic Frontier Foundation and The Tor Project
Stable release
2018.10.31 / 1 November 2018; 20 days ago (2018-11-01)[1][2]
Repository Edit this at Wikidata
Written inJavaScript, Python
PlatformFirefox for Android
Google Chrome
Mozilla Firefox
Opera
Brave
TypeBrowser extension
LicenseGNU GPL v3+ (most code is v2 compatible)[3]
Websiteeff.org/https-everywhere
As ofApril 2014

HTTPS Everywhere is a free and open-source browser extension for Google Chrome, Mozilla Firefox, Opera, Brave, and Firefox for Android, which is developed collaboratively by The Tor Project and the Electronic Frontier Foundation (EFF).[4] It automatically makes websites use a more secure HTTPS connection instead of HTTP, if they support it.[5] The option "Block all HTTP requests" makes it possible to block and unblock all non-HTTPS browser connections with one click.[6]

Development[edit]

HTTPS Everywhere was inspired by Google's increased use of HTTPS[7] and is designed to force the usage of HTTPS automatically whenever possible.[8] The code, in part, is based on NoScript's HTTP Strict Transport Security implementation, but HTTPS Everywhere is intended to be simpler to use than NoScript's force HTTPS functionality which requires the user to manually add websites to a list.[4] The EFF provides information for users on how to add HTTPS rulesets to HTTPS Everywhere,[9] and information on which websites support HTTPS.[10]

Platform support[edit]

A public beta of HTTPS Everywhere for Firefox was released in 2010,[11] and version 1.0 was released in 2011.[12] A beta for Chrome was released in February 2012.[13] In 2014, a version was released for Android phones.[14]

SSL Observatory[edit]

The SSL Observatory is a feature in HTTPS Everywhere introduced in version 2.0.1[13] which analyzes public key certificates to determine if certificate authorities have been compromised,[15] and if the user is vulnerable to man-in-the-middle attacks.[16] In 2013, the ICANN Security and Stability Advisory Committee (SSAC) noted that the data set used by the SSL Observatory often treated intermediate authorities as different entities, thus inflating the number of certificate authorities. The SSAC criticized SSL Observatory for potentially significantly undercounting internal name certificates, and noted that it used a data set from 2010.[17]

Continual Ruleset Updates[edit]

The update to Version 2018.4.3, shipped 3 April 2018, introduces the "Continual Ruleset Updates" function.[18] To apply up-to-date https-rules, this update function executes one rule-matching within 24 hours. A website called https://www.https-rulesets.org/ was built by the EFF for this purpose. This automated update function can be disabled in the add-on settings. Prior the update- mechanism there have been ruleset-updates only through app-updates. Even after this feature was implemented there are still bundled rulesets shipped within app-updates.

Reception[edit]

Two studies have recommended building in HTTPS Everywhere functionality into Android browsers.[19][20] In 2012, Eric Phetteplace described it as "perhaps the best response to Firesheep-style attacks available for any platform".[21] In 2011, Vincent Toubiana and Vincent Verdot pointed out some drawbacks of the HTTPS Everywhere add-on, including that the list of services which support HTTPS needs maintaining, and that some services are redirected to HTTPS even though they are not yet available in HTTPS, not allowing the user of the extension to get to the service.[22]

See also[edit]

References[edit]

  1. ^ "Changelog.txt". Electronic Frontier Foundation. Retrieved 16 April 2018.
  2. ^ "Releases · EFForg/https-everywhere". GitHub. Retrieved 16 April 2018.
  3. ^ HTTPS Everywhere Development Electronic Frontier Foundation
  4. ^ a b "HTTPS Everywhere". Electronic Frontier Foundation. Retrieved 14 April 2014.
  5. ^ "HTTPS Everywhere reaches 2.0, comes to Chrome as beta". H-online.com. 29 February 2012. Retrieved 14 April 2014.
  6. ^ HTTPS Everywhere Changelog (englisch)
  7. ^ "Automatic web encryption (almost) everywhere - The H Open Source: News and Features". H-online.com. 2010-06-18. Archived from the original on 2010-06-23. Retrieved 2014-04-15.
  8. ^ Murphy, Kate (16 February 2011). "New Hacking Tools Pose Bigger Threats to Wi-Fi Users". The New York Times.
  9. ^ "HTTPS Everywhere Rulesets". Electronic Frontier Foundation. 24 January 2014. Retrieved 19 May 2014.
  10. ^ "HTTPS Everywhere Atlas". Electronic Frontier Foundation. Retrieved 24 May 2014.
  11. ^ Mills, Elinor (18 June 2010). "Firefox add-on encrypts sessions with Facebook, Twitter". CNET. Retrieved 14 April 2014.
  12. ^ Gilbertson, Scott (5 August 2011). "Firefox Security Tool HTTPS Everywhere Hits 1.0". Wired. Retrieved 14 April 2014.
  13. ^ a b Eckersley, Peter (29 February 2012). "HTTPS Everywhere & the Decentralized SSL Observatory". Electronic Frontier Foundation. Retrieved 4 June 2014.
  14. ^ Brian, Matt (27 January 2014). "Browsing on your Android phone just got safer, thanks to the EFF". Engadget. Retrieved 14 April 2014.
  15. ^ Lemos, Robert (21 September 2011). "EFF builds system to warn of certificate breaches". InfoWorld. Retrieved 14 April 2014.
  16. ^ Vaughan, Steven J. (28 February 2012). "New 'HTTPS Everywhere' Web browser extension released". ZDNet. Retrieved 14 April 2014.
  17. ^ "1 SSAC Advisory on Internal Name Certificates" (PDF). ICANN Security and Stability Advisory Committee (SSAC). 15 March 2013.
  18. ^ Abrams, Lawrence (5 April 2018). "HTTPS Everywhere Now Delivers New Rulesets Without Upgrading Extension". BleepingComputer.
  19. ^ Fahl, Sascha; et al. "Why Eve and Mallory love Android: An analysis of Android SSL (in)security" (PDF). Proceedings of the 2012 ACM conference on Computer and communications security. ACM, 2012. Archived from the original (PDF) on 2013-01-08.
  20. ^ Davis, Benjamin; Chen, Hao (June 2013). "Retro Skeleton". Proceedings of the 11th annual international conference on Mobile systems, applications, and services - Mobi Sys '13. pp. 181–192. doi:10.1145/2462456.2464462. ISBN 9781450316729.
  21. ^ Kern, M. Kathleen, and Eric Phetteplace. "Hardening the browser." Reference & User Services Quarterly 51.3 (2012): 210-214. http://eprints.rclis.org/16837/
  22. ^ Toubiana, Vincent; Verdot, Vincent (2011). "Show Me Your Cookie And I Will Tell You Who You Are". arXiv:1108.5864 [cs.CR].