-
Notifications
You must be signed in to change notification settings - Fork 0
/
why-https.html
389 lines (263 loc) · 24.8 KB
/
why-https.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
<!DOCTYPE html>
<html>
<head>
<title>Why HTTPS?</title>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
<meta name="viewport" content="width=device-width, initial-scale=1.0"/>
<link rel="stylesheet" type="text/css" href="files/main_style.css" title="wsite-theme-css" />
<link rel="icon" type="image/png" href="favicon.png" />
<style type='text/css'>
.wsite-elements.wsite-not-footer div.paragraph, .wsite-elements.wsite-not-footer p, .wsite-elements.wsite-not-footer .product-block .product-title, .wsite-elements.wsite-not-footer .product-description, .wsite-elements.wsite-not-footer .wsite-form-field label, .wsite-elements.wsite-not-footer .wsite-form-field label, #wsite-content div.paragraph, #wsite-content p, #wsite-content .product-block .product-title, #wsite-content .product-description, #wsite-content .wsite-form-field label, #wsite-content .wsite-form-field label, .blog-sidebar div.paragraph, .blog-sidebar p, .blog-sidebar .wsite-form-field label, .blog-sidebar .wsite-form-field label {font-family:"Roboto" !important;line-height:27px !important;}
#wsite-content div.paragraph, #wsite-content p, #wsite-content .product-block .product-title, #wsite-content .product-description, #wsite-content .wsite-form-field label, #wsite-content .wsite-form-field label, .blog-sidebar div.paragraph, .blog-sidebar p, .blog-sidebar .wsite-form-field label, .blog-sidebar .wsite-form-field label {color:#fff !important;}
.wsite-elements.wsite-footer div.paragraph, .wsite-elements.wsite-footer p, .wsite-elements.wsite-footer .product-block .product-title, .wsite-elements.wsite-footer .product-description, .wsite-elements.wsite-footer .wsite-form-field label, .wsite-elements.wsite-footer .wsite-form-field label{}
.wsite-elements.wsite-not-footer h2, .wsite-elements.wsite-not-footer .product-long .product-title, .wsite-elements.wsite-not-footer .product-large .product-title, .wsite-elements.wsite-not-footer .product-small .product-title, #wsite-content h2, #wsite-content .product-long .product-title, #wsite-content .product-large .product-title, #wsite-content .product-small .product-title, .blog-sidebar h2 {font-family:"Sansation" !important;font-weight:700 !important;text-transform: none !important;}
#wsite-content h2, #wsite-content .product-long .product-title, #wsite-content .product-large .product-title, #wsite-content .product-small .product-title, .blog-sidebar h2 {color:#44d531 !important;}
.wsite-elements.wsite-footer h2, .wsite-elements.wsite-footer .product-long .product-title, .wsite-elements.wsite-footer .product-large .product-title, .wsite-elements.wsite-footer .product-small .product-title{}
#wsite-title {font-family:"Sansation" !important;font-weight:700 !important;color:#29f935 !important;font-style:normal !important;text-transform: none !important;}
.wsite-not-footer h2.wsite-content-title a, .wsite-not-footer .paragraph a, .wsite-not-footer blockquote a, #blogTable .blog-sidebar a, #blogTable .blog-comments a, #blogTable .blog-comments-bottom a, #wsite-com-store a, #wsite-com-product-gen a {color:#d817d8 !important;}
.wsite-menu-default a {font-family:"Sansation" !important;font-weight:400 !important;text-transform: none !important;}
.wsite-menu a {}
.wsite-image div, .wsite-caption {}
.wsite-headline {font-family:"Sansation" !important;font-size:86px !important;font-weight:700 !important;line-height:20px !important;font-style:normal !important;text-transform: none !important;}
.wsite-headline-paragraph {font-family:"Stoke" !important;text-transform: none !important;}
.wsite-button-inner {}
.wsite-not-footer blockquote {}
.wsite-footer blockquote {}
.blog-header h2 a {}
#wsite-content h2.wsite-product-title {}
.wsite-product .wsite-product-price a {}
.wsite-not-footer h2.wsite-content-title a:hover, .wsite-not-footer .paragraph a:hover, .wsite-not-footer blockquote a:hover, #blogTable .blog-sidebar a:hover, #blogTable .blog-comments a:hover, #blogTable .blog-comments-bottom a:hover, #wsite-com-store a:hover, #wsite-com-product-gen a:hover {color:#46daa0 !important;}
</style>
<script src='https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js'></script>
</head>
<body class="no-header-page wsite-theme-dark wsite-page-why-https"><div class="wrapper">
<div class="paris-header">
<div class="container">
<label class="hamburger"><span></span></label>
<div class="logo"><span class="wsite-logo">
<a href="">
<span id="wsite-title">SecureUtah.org</span>
</a>
</span></div>
<div class="nav desktop-nav"><ul class="wsite-menu-default">
<li id="pg355222250483215893"
class="wsite-menu-item-wrap"
>
<a href="index.html"
class="wsite-menu-item"
>
Home
</a>
</li>
<li id="active"
class="wsite-menu-item-wrap"
>
<a href="why-https.html"
class="wsite-menu-item"
>
Why HTTPS?
</a>
</li>
<li id="pg985763262297598903"
class="wsite-menu-item-wrap"
>
<a href="utahwatch.html"
class="wsite-menu-item"
>
UtahWatch
</a>
</li>
<li id="pg975310647192145519"
class="wsite-menu-item-wrap"
>
<a href="resources.html"
class="wsite-menu-item"
>
Resources
</a>
</li>
<li id="pg994273301206676077"
class="wsite-menu-item-wrap"
>
<a href="about.html"
class="wsite-menu-item"
>
About
</a>
</li>
</ul>
</div>
</div><!-- end .container -->
</div><!-- end .header -->
<div class="main-wrap">
<div class="container">
<div class="content-wrap"><div id='wsite-content' class='wsite-elements wsite-not-footer'>
<div><div class="wsite-image wsite-image-border-none " style="padding-top:10px;padding-bottom:10px;margin-left:0px;margin-right:0px;text-align:center">
<a>
<img src="whyhttps.png?960" alt="Picture" style="width:960;max-width:100%" />
</a>
<div style="display:block;font-size:90%"></div>
</div></div>
<div class="wsite-spacer" style="height:25px;"></div>
<div><div class="wsite-multicol"><div class="wsite-multicol-table-wrap" style="margin:0 -15px;">
<table class="wsite-multicol-table">
<tbody class="wsite-multicol-tbody">
<tr class="wsite-multicol-tr">
<td class="wsite-multicol-col" style="width:9.5952262874328%; padding:0 15px;">
<div class="wsite-spacer" style="height:50px;"></div>
</td> <td class="wsite-multicol-col" style="width:80.80873627939%; padding:0 15px;">
<div class="paragraph" style="text-align:center;"><span><font size="5"><font color="#29f935">All</font> web traffic should be delivered securely between a website and its visitors. HTTPS is the network protocol that creates an encrypted communication channel that protects <font color="#29f935">your</font> data as it travels over an insecure Internet.</font></span></div>
<div><div style="height: 20px; overflow: hidden; width: 100%;"></div>
<hr class="styled-hr" style="width:100%;"></hr>
<div style="height: 20px; overflow: hidden; width: 100%;"></div></div>
<h2 class="wsite-content-title" style="text-align:center;"><font size="6">Integrity & Authenticity</font></h2>
<div class="paragraph" style="text-align:left;"><font size="4"> HTTPS provides the best method for a website owner to deliver their content to their visitors exactly as it was designed and without any extra code inserted or removed by a third party. The security components within HTTPS require that the website authenticate itself to the visitor’s browser at the very beginning of the connection while also allowing the browser to perform validation checks against the server’s authentication claims.</font></div>
<div><div style="height: 20px; overflow: hidden; width: 100%;"></div>
<hr class="styled-hr" style="width:100%;"></hr>
<div style="height: 20px; overflow: hidden; width: 100%;"></div></div>
<h2 class="wsite-content-title" style="text-align:center;"><font size="6">The Network is Hostile</font></h2>
<div class="paragraph" style="text-align:left;"><span id="selectionBoundary_1455663816630_48382306657731533"> </span><font size="4">The path that web traffic takes across the Internet is often unpredictable and increasingly unsafe. Unencrypted web traffic is regularly intercepted, shamelessly manipulated, and arbitrarily censored, usually without the visitor or website owner knowing that these actions are taking place.<br /><br />​ With HTTPS the website can only be delivered whole or not at all. HTTPS encloses all of a website’s data, defending against in-transit snooping and tampering as it moves through an unfortunately adverse environment.</font></div>
<div><div style="height: 20px; overflow: hidden; width: 100%;"></div>
<hr class="styled-hr" style="width:100%;"></hr>
<div style="height: 20px; overflow: hidden; width: 100%;"></div></div>
<h2 class="wsite-content-title" style="text-align:center;"><font size="6">All Traffic is Sensitive</font></h2>
<div class="paragraph" style="text-align:left;"><font size="4"> Regular unencrypted HTTP connections to websites are a privacy vulnerability and they will always expose sensitive personal information. Third parties monitoring an HTTP connection will see a website visitor's physical location identifiers, login credentials, camera and audio feeds, search terms, medical conditions, political interests, and reading material.<br /><br /> HTTPS helps stop third parties from seeing and tracking the specific content a website visitor looks at. All Internet data should be given the same high level of privacy and protection, whether the website content be social, financial, medical, legal, political, scholarly, or religious.</font></div>
<div><div style="height: 20px; overflow: hidden; width: 100%;"></div>
<hr class="styled-hr" style="width:100%;"></hr>
<div style="height: 20px; overflow: hidden; width: 100%;"></div></div>
<h2 class="wsite-content-title" style="text-align:center;">You Love Your Users</h2>
<div class="paragraph" style="text-align:left;"><font size="4"> It is the ethical duty of a website owner to provide their visitors with the most secure and safest connection method available. Enabling HTTPS directly benefits a website’s users while also helping the larger Internet — encrypting a website’s traffic removes a number of dangerous avenues of attack that are used by bad actors and malicious entities.<br /><br />​ With an abundance of online resources and guides the technical process of adding HTTPS is a solved problem for the large majority of websites. The dollar cost to obtain the required HTTPS authentication certificates has dropped to zero. With clear security benefits and the prevailing technical and financial hurdles of the past all but gone, choosing to provide HTTPS is now a matter of principle that should be eagerly embraced.​</font></div>
<div><div style="height: 20px; overflow: hidden; width: 100%;"></div>
<hr class="styled-hr" style="width:100%;"></hr>
<div style="height: 20px; overflow: hidden; width: 100%;"></div></div>
<h2 class="wsite-content-title" style="text-align:center;">Best Practice</h2>
<div class="paragraph" style="text-align:left;"><font size="4"> Two of the major web browsers are already guiding web development away from insecure HTTP connections and towards an all-HTTPS web. Mozilla <a href="https://blog.mozilla.org/security/2015/04/30/deprecating-non-secure-http/" target="_blank">announced</a> in April 2015 that they will gradually reduce the website features that Firefox is allowed to access over HTTP connections. Google <a href="http://www.chromium.org/Home/chromium-security/marking-http-as-non-secure" target="_blank">will soon update Chrome</a> to visually warn users that HTTP connections are not secure. Both companies are working on developing and promoting a number of other background technical processes that will make HTTPS connections faster and more secure.<br /><br /> Three of the Internet’s technical standards bodies have released statements in support of ubiquitous encryption to combat monitoring and manipulation. The <a href="https://tools.ietf.org/html/rfc7258" target="_blank">IETF</a>, <a href="https://www.iab.org/2014/11/14/iab-statement-on-internet-confidentiality/" target="_blank">IAB</a> and <a href="https://w3ctag.github.io/web-https/#other-concerns-about-https" target="_blank"> W3C</a> help define the development and construction of Internet communication and web traffic. Their strong support for encrypted traffic serves as a bellweather for how the Internet of the near future will take shape.</font></div>
<div><div style="height: 20px; overflow: hidden; width: 100%;"></div>
<hr class="styled-hr" style="width:100%;"></hr>
<div style="height: 20px; overflow: hidden; width: 100%;"></div></div>
<div><div style="height: 20px; overflow: hidden; width: 100%;"></div>
<hr class="styled-hr" style="width:100%;"></hr>
<div style="height: 20px; overflow: hidden; width: 100%;"></div></div>
</td> <td class="wsite-multicol-col" style="width:9.5960374331775%; padding:0 15px;">
<div class="wsite-spacer" style="height:50px;"></div>
</td> </tr>
</tbody>
</table>
</div></div></div>
<div><div class="wsite-multicol"><div class="wsite-multicol-table-wrap" style="margin:0 -15px;">
<table class="wsite-multicol-table">
<tbody class="wsite-multicol-tbody">
<tr class="wsite-multicol-tr">
<td class="wsite-multicol-col" style="width:9.5959595959596%; padding:0 15px;">
<div class="wsite-spacer" style="height:50px;"></div>
</td> <td class="wsite-multicol-col" style="width:90.40404040404%; padding:0 15px;">
<div><div class="wsite-multicol"><div class="wsite-multicol-table-wrap" style="margin:0 -15px;">
<table class="wsite-multicol-table">
<tbody class="wsite-multicol-tbody">
<tr class="wsite-multicol-tr">
<td class="wsite-multicol-col" style="width:90.167597765363%; padding:0 15px;">
<h2 class="wsite-content-title" style="text-align:center;"><font size="7"> </font><font color="#3be0ed"><font size="7">Further Reading</font></font></h2>
<div class="paragraph" style="text-align:left;"><font size="4">The following writings have directly inspired the creation and fueled the development of this website. For a deeper understanding of why HTTPS, secure communications, and user privacy are important for the modern web please continue reading. The authors' names provide links to their entire text.</font></div>
<div><div style="height: 20px; overflow: hidden; width: 100%;"></div>
<hr class="styled-hr" style="width:100%;"></hr>
<div style="height: 20px; overflow: hidden; width: 100%;"></div></div>
<h2 class="wsite-content-title" style="text-align:left;"><font size="6">Why you should care about HTTPS</font></h2>
<div class="paragraph" style="text-align:left;"><font size="4">Traditionally, the arguments in favor of HTTPS have been for integrity, privacy, and identity. If a message is encrypted by a server before it’s sent to your computer, and its done in such a way that only you can decrypt it, you can have a high level of confidence that the message you receive is the message the server sent (integrity), and that you’re the only one who opened it (privacy). Further still, because of the initial handshake that makes all this possible, you know that the server you’re talking to is the one you want to talk to, and not someone else pretending to be the server (identity).<br /><br />Without HTTPS, there’s a couple of points in the route each request must take that could allow a third-party to intercept, or worse, modify your request or its response as it travels over the open internet.<br />​​</font><br /><a target="_blank" href="http://ben.balter.com/2015/01/06/https-all-the-things/"><strong><font size="5">— Ben Balter</font></strong></a></div>
<div><div style="height: 20px; overflow: hidden; width: 100%;"></div>
<hr class="styled-hr" style="width:100%;"></hr>
<div style="height: 20px; overflow: hidden; width: 100%;"></div></div>
<h2 class="wsite-content-title" style="text-align:left;"><font size="6">The Network is Hostile</font></h2>
<div class="paragraph" style="text-align:left;"><font size="4">Anyone who has taken a network security class knows that the first rule of Internet security is that <span>there is no Internet security</span>. Indeed, this assumption is baked into the design of the Internet and most<span> </span>packet-switched networks — systems where unknown third parties are responsible for handling and routing your data. There is no way to ensure that your packets will be routed as you want them, and there’s absolutely no way to ensure that they won’t be looked at.<br /><br />Indeed, the implications of this were obvious as far back as <a href="https://en.wikipedia.org/wiki/ARPANET">ARPANET</a>. If you connect from point A to point B, it was well known that your packets would traverse untrusted machines C, D and E in between. In the 1970s the only thing preserving the privacy of your data was a gentleman’s agreement not to peek. If that wasn’t good enough, the network engineers argued, you had to <a href="http://users.ece.cmu.edu/~adrian/630-f04/readings/bellovin-tcp-ip.pdf">provide your own security</a> between the endpoints themselves.<br /><br />My take from the NSA revelations is that even though this point was ‘obvious’ and well-known, we’ve always felt it more intellectually than in our hearts. Even knowing the worst was possible, we still chose to believe that direct peering connections and leased lines from reputable providers like AT&T would make us safe. If nothing else, the NSA leaks have convincingly refuted this assumption.</font><br /><br /><a target="_blank" href="https://blog.cryptographyengineering.com/2015/08/the-network-is-hostile.html"><strong><font size="5">— Matthew Green</font></strong></a></div>
<div><div style="height: 20px; overflow: hidden; width: 100%;"></div>
<hr class="styled-hr" style="width:100%;"></hr>
<div style="height: 20px; overflow: hidden; width: 100%;"></div></div>
<h2 class="wsite-content-title" style="text-align:left;"><font size="6">Why HTTPS for Everything?</font></h2>
<div class="paragraph" style="text-align:left;"><font size="4">HTTP has become central to today’s way of life. HTTP is currently the primary protocol for applications used on computers, tablets, smartphones, and many other devices.<br /><br />As our dependency on the internet has grown, the risk to users’ privacy and safety has grown along with it.<br /><br />Every unencrypted HTTP request reveals information about a user’s behavior, and the interception and tracking of unencrypted browsing has become commonplace.<br /><br />Today, <span style="font-weight:700">there is no such thing as non-sensitive web traffic</span>, and public services should not depend on the benevolence of network operators.<br /><br />When properly configured, HTTPS can provide a fast, secure connection that offers the level of privacy and reliability that users should expect from government web services.</font><br /><br /><a target="_blank" href="https://https.cio.gov/everything/"><strong><font size="5">— White House Office of Management and Budget</font></strong></a></div>
<div><div style="height: 20px; overflow: hidden; width: 100%;"></div>
<hr class="styled-hr" style="width:100%;"></hr>
<div style="height: 20px; overflow: hidden; width: 100%;"></div></div>
<h2 class="wsite-content-title" style="text-align:left;"><font size="6">Deprecating Non-Secure HTTP</font></h2>
<div class="paragraph" style="text-align:left;"><font size="4">Q. But there’s nothing secret on my site! Why should I bother with encryption?<br /><br />A. HTTPS isn’t just about encryption. It also provides integrity, so your site can’t be modified, and authentication, so users know they’re connecting to you and not some attacker. Lacking any one of these three properties can cause problems…<br /><br />In other words, as long as your site is not secure, it can be used as a weapon against your users and against other web sites. More non­secure sites means more risk for the overall Web.</font><br /><br /><a href="https://blog.mozilla.org/security/files/2015/05/HTTPS-FAQ.pdf" target="_blank"><font size="5"><strong>— Richard Barnes</strong></font></a></div>
<div><div style="height: 20px; overflow: hidden; width: 100%;"></div>
<hr class="styled-hr" style="width:100%;"></hr>
<div style="height: 20px; overflow: hidden; width: 100%;"></div></div>
<h2 class="wsite-content-title" style="text-align:left;"><font size="6">We're Deprecating HTTP And It's Going to Be Okay</font></h2>
<div class="paragraph" style="text-align:left;"><font size="4">I see companies and government asserting themselves over <span>their</span> network. I see a network that is not just overseen, but actively hostile. I see an internet being steadily drained of its promise to <a href="https://en.wikiquote.org/wiki/John_Gilmore" title="">“interpret censorship as damage”</a>.<br /><br />In short, I see power moving away from the leafs and devolving back into the center, where power has been used to living for thousands of years.<br /><br />What animates me is knowing that <span style="font-weight:700">we can actually change this dynamic</span> by making strong encryption ubiquitous. We can force online surveillance to be as narrowly targeted and inconvenient as law enforcement was always meant to be. We can force ISPs to be the neutral commodity pipes they were always meant to be. On the web, that means HTTPS.</font><br /><br /><a href="https://konklone.com/post/were-deprecating-http-and-its-going-to-be-okay" target="_blank" title=""><font size="5"><strong>— Eric Mill</strong></font></a></div>
<div><div style="height: 20px; overflow: hidden; width: 100%;"></div>
<hr class="styled-hr" style="width:100%;"></hr>
<div style="height: 20px; overflow: hidden; width: 100%;"></div></div>
<h2 class="wsite-content-title" style="text-align:left;"><font size="6">How to Get a Company or Organisation to implement an Onion Site</font></h2>
<div class="paragraph" style="text-align:left;"><font size="4">People who want to access your site are at risk. You know how many people. If it’s reasonably cheap to do so — </font><span style="font-size: large;">and it is reasonably cheap</span><font size="4"> — are you willing to make an affordance for these people to be more secure and have a better experience when accessing your site?</font><br /><font size="4">​</font><br /><a target="_blank" href="https://www.facebook.com/notes/alec-muffett/how-to-get-a-company-or-organisation-to-implement-an-onion-site-ie-a-tor-hidden-/10153762090530962"><strong><font size="5">— Alec Muffett</font></strong></a></div>
</td> <td class="wsite-multicol-col" style="width:9.8324022346369%; padding:0 15px;">
<div class="wsite-spacer" style="height:50px;"></div>
</td> </tr>
</tbody>
</table>
</div></div></div>
</td> </tr>
</tbody>
</table>
</div></div></div>
<div><div style="height: 20px; overflow: hidden; width: 100%;"></div>
<hr class="styled-hr" style="width:100%;"></hr>
<div style="height: 20px; overflow: hidden; width: 100%;"></div></div>
<div><div style="height: 20px; overflow: hidden; width: 100%;"></div>
<hr class="styled-hr" style="width:100%;"></hr>
<div style="height: 20px; overflow: hidden; width: 100%;"></div></div></div>
</div>
</div><!-- end container -->
</div>
</div>
<div class="nav mobile-nav">
<label class="hamburger"><span></span></label>
<ul class="wsite-menu-default">
<li id="pg355222250483215893"
class="wsite-menu-item-wrap"
>
<a href="index.html"
class="wsite-menu-item"
>
Home
</a>
</li>
<li id="active"
class="wsite-menu-item-wrap"
>
<a href="why-https.html"
class="wsite-menu-item"
>
Why HTTPS?
</a>
</li>
<li id="pg985763262297598903"
class="wsite-menu-item-wrap"
>
<a href="utahwatch.html"
class="wsite-menu-item"
>
UtahWatch
</a>
</li>
<li id="pg975310647192145519"
class="wsite-menu-item-wrap"
>
<a href="resources.html"
class="wsite-menu-item"
>
Resources
</a>
</li>
<li id="pg994273301206676077"
class="wsite-menu-item-wrap"
>
<a href="about.html"
class="wsite-menu-item"
>
About
</a>
</li>
</ul>
</div>
<script type="text/javascript" src="files/theme/custom.js"></script>
</body>
</html>