Free HTTPS for all

This year will see the introduction of free HTTPS certificates from the Electronic Frontier Foundation (EFF) as part of its drive to get everyone around the world wide web taking up the “HTTPS Everywhere” mantra.
Research released at the start of this year by GlobalSign of 6,000 consumers found that 96 per cent of website visitors would not continue with a purchase if they saw an invalid SSL certificate, while 75 per cent would close the page if it had a secure connection with unsecure elements.
Also, research released by HP Fortify of applications found that 18 per cent of those tested sent user names and passwords over HTTP. Of the remaining 82 per cent, 18 per cent incorrectly implemented SSL/HTTPS.
Now that HP Fortify research was from some time ago, but to me it showed the problem with deemed secure internet connections – it is all very well showing your intent but if you implement incorrectly or use an out of date standard such as SSL version 3.
The issue of HTTPS comes around time and time again. In a story from last week, the global dating website Match.com was found to not be using an SSL certificate, whilst on its last Patch Tuesday, Microsoft removed the troublesome SSL v3 in the latest version of Internet Explorer after the world pounced to patch one year ago in the wake of the revelations of the Heartbleed bug.
But then, there is positive news, and we have seen Yahoo and Gmail deploy HTTPS for more secure webmail use, and with the announcements by Google and the EFF show the industry’s drive for more online security for users.
I spoke with Simon Wood, UK CTO of GlobalSign, about the EFF effort and if the concept of free SSL certificates and he said that he had seen other certificate authorities (CAs) push for this. He said that while this was essentially free domain validation certificates (freeDV), which do not provide a lot of control for the domain owner as you can only prove the site which you are going to, he did said that the idea was “cheap and it is easy and gives you transport protection and ticks the basic boxes”, and said that other CAs would welcome this.
Last year, Google announced plans to rank those HTTPS-enabled websites higher in search results, which Wood acknowledged was “great for users”, as this means that they do not have to be cautious about which websites they are visiting.
“If it was just the EFF, then there would be a small change in terms of forcing the drive to HTTPS, but the two together (including Google pushing HTTPS) is driving it and it is a good move and protects the consumer and users,” he said.
Wood acknowledged that from the perspective of a CA, it is a fantastic move as there is a drive for people to buy business products. “From an industry point of view it does impact the small ISPs and one man bands whose livelihood is to build custom sites, and now their customers are saying that they need certificates or users will get errors using Chrome,” he said.
“If your website generates errors that is enough to put customers off, so it is driving those with small infrastructure costs to get up to this level.”
There is some good and bad with SSL and as we saw with Heartbleed and the revocation SSL v3 in Internet Explorer last week, there is some work to be done. What any collaborative effort needs is backing and leadership, and the move to HTTPS appears to have that.
 
This article originally appeared at Foursys.co.uk