HTTPS is gradually becoming the preferred means to connect to websites, perhaps driven in part by Google's interest in using the protocol's availability as a ranking signal in search results as well as its plans to have Chrome mark HTTP sites as "not secure" in a few month's time. The move may also have been aided by automatic certificate authority, Let's Encrypt, which has issued over 100 million certificates as of last June.
While the use of secure HTTP helps improve the security of the content that is consumed when browsing the web, it may not always be leveraged if available, particularly if a website lacks HTTP Strict Transport Security (HSTS) or other means to switch connections to HTTPS are absent. Of course, there have been browser add-ons such as HTTPS Everywhere which have sought to eliminate the guesswork for users in this regard. However, in order for updated lists to be deployed, the Electronic Frontier Foundation (EFF) has had to push a brand new version of its add-on, but now that's set to change.
As stated in its announcement, the EFF will decouple its ruleset updates from those for the HTTPS Everywhere extension itself. It will instead check for new lists every so often and download the latest one when detected. Also, to ensure security and integrity, ruleset updates will be signed to ensure that they are not being delivered from nefarious sources. It will also be possible for third parties to build their own lists which can then be incorporated into their own customized versions of the add-on.
The change is just the precursor to others being explored, such as a means to deliver the delta between rulesets in order to avoid bandwidth wastage. HTTPS Everywhere version 2018.4.3 is available to download here for Firefox, Chrome, and Opera.
2 Comments - Add comment