HTTPS Everywhere

» see eff.org/https-everywhere as it lived, on the wayback machine

~ the obit ~

This one belongs in the small category of dead software that died from being right. HTTPS Everywhere arrived in the years when a Firefox install meant a base browser plus a folder of extensions you had collected over time, and it was the one on that list with the least visible effect. You installed it and nothing changed, except that the padlock appeared on sites where it had not been before. That was the whole product.

It was released as a public beta on 17 June 2010, a joint project of the Electronic Frontier Foundation and the Tor Project. The trigger was Google switching on encrypted search, which made it obvious that the technology was sitting right there and that almost nobody was using it. In 2010 a site that supported HTTPS usually supported it badly, offering it on the login page and dropping you back to plain HTTP for everything after.

The mechanism was crude and it worked. The extension shipped rulesets, XML files saying which URLs on which domains could be safely rewritten from http to https, and it rewrote them in the browser before the request went out. Every one of those rules had been written by a person who checked that the site's HTTPS version actually functioned. At its largest the ruleset library covered tens of thousands of domains, and it was maintained the way a library is maintained, by hand and without end.

~ the rap sheet ~

~ what it was arguing with ~

The case against HTTPS in 2010 was economics. Certificates cost money and TLS cost CPU. A site owner handling no passwords and no payments could not see what the expense was buying. Firesheep shipped that October and answered the question by turning session hijacking on open wifi into a one-click Firefox extension anybody could run from a coffee shop, and the argument moved considerably faster afterward.

The rest of it was won by other people. Let's Encrypt started issuing free certificates in 2015 and took the money argument off the table. Browsers began labeling plain HTTP pages as not secure. HTTPS Everywhere was the thing that kept the gap visible while that work happened, and the visibility was arguably the useful part of it.

~ the win that killed it ~

Firefox shipped HTTPS-only mode in 2020 and Chrome followed a year later. Once a browser will upgrade every request by itself, a hand-checked list of rules for specific sites is not merely unnecessary, it is worse, because it is a list that can go stale. On 21 September 2021 the EFF published a post saying the goal had always been to become redundant and that it now had. The extension went into maintenance mode through 2022, took its last release on 25 May 2022 and was retired in January 2023.

Software that ends this way is rare enough to be worth marking. Nothing was acquired and nobody lost a lawsuit. It existed to make an argument about how the web ought to work. The web agreed, and the argument stopped needing a place in anyone's toolbar. The padlock it spent twelve years chasing is now so ordinary that browsers have stopped bothering to draw it.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »