HTTPS
The principal motivations for HTTPS are authentication of the accessed website and protection of the privacy and integrity of the exchanged data while it is in transit.
In 2016, a campaign by the Electronic Frontier Foundation with the support of web browser developers led to the protocol becoming more prevalent.
This ensures reasonable protection from eavesdroppers and man-in-the-middle attacks, provided that adequate cipher suites are used and that the server certificate is verified and trusted.
However, because website addresses and port numbers are necessarily part of the underlying TCP/IP protocols, HTTPS cannot protect their disclosure.
[4] Web browsers know how to trust HTTPS websites based on certificate authorities that come pre-installed in their software.
Additionally, some free-to-use and paid WLAN networks have been observed tampering with webpages by engaging in packet injection in order to serve their own ads on other websites.
This practice can be exploited maliciously in many ways, such as by injecting malware onto webpages and stealing users' private information.
[11][12][13] Deploying HTTPS also allows the use of HTTP/2 and HTTP/3 (and their predecessors SPDY and QUIC), which are new HTTP versions designed to reduce page load times, size, and latency.
It is recommended to use HTTP Strict Transport Security (HSTS) with HTTPS to protect users from man-in-the-middle attacks, especially SSL stripping.
Older browsers, when connecting to a site with an invalid certificate, would present the user with a dialog box asking whether they wanted to continue.
[19][20] Forcing a web browser to load only HTTPS content has been supported in Firefox starting in version 83.
While this can be more beneficial than verifying the identities via a web of trust, the 2013 mass surveillance disclosures drew attention to certificate authorities as a potential weak point allowing man-in-the-middle attacks.
[24][25] An important property in this context is forward secrecy, which ensures that encrypted communications recorded in the past cannot be retrieved and decrypted should long-term secret keys or passwords be compromised in the future.
Strictly speaking, HTTPS is not a separate protocol, but refers to the use of ordinary HTTP over an encrypted SSL/TLS connection.
Let's Encrypt, launched in April 2016,[27] provides free and automated service that delivers basic SSL/TLS certificates to websites.
[28] According to the Electronic Frontier Foundation, Let's Encrypt will make switching from HTTP to HTTPS "as easy as issuing one command, or clicking one button.
Newer versions of popular browsers such as Firefox,[32] Opera,[33] and Internet Explorer on Windows Vista[34] implement the Online Certificate Status Protocol (OCSP) to verify that this is not the case.
[citation needed] SSL/TLS does not prevent the indexing of the site by a web crawler, and in some cases the URI of the encrypted resource can be inferred by knowing only the intercepted request/response size.
Support for SNI is available since Firefox 2, Opera 8, Apple Safari 2.1, Google Chrome 6, and Internet Explorer 7 on Windows Vista.
[45] The fact that most modern websites, including Google, Yahoo!, and Amazon, use HTTPS causes problems for many users trying to access public Wi-Fi hot spots, because a captive portal Wi-Fi hot spot login page fails to load if the user tries to open an HTTPS resource.
Google announced in February 2018 that its Chrome browser would mark HTTP sites as "Not Secure" after July 2018.
[50] This move was to encourage website owners to implement HTTPS, as an effort to make the World Wide Web more secure.
