Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Finalizing the HTTPS-Only Standard as formal policy #108

Merged
merged 15 commits into from
Jun 8, 2015
Merged

Finalizing the HTTPS-Only Standard as formal policy #108

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
45fedec
Remove 'perfect' from forward secrecy section
titanous Mar 17, 2015
6cb9a30
Changes per IETF IAB comments
josephlhall Apr 9, 2015
eee26c9
Tweaks to IETF submitted changes.
konklone Apr 17, 2015
19c0a26
Emphasize that the HSTS max-age is also part of the requirement.
konklone Apr 17, 2015
983bb1d
remove public comment paragraph
konklone Apr 17, 2015
e187758
technical assistance paragraph was duplicated
konklone Apr 17, 2015
af9fe24
Merge branch 'patch-1' of https://github.com/titanous/https into changes
konklone Apr 17, 2015
7f0836c
Be more explicit about planning for change, mention FS.
konklone Apr 17, 2015
725b141
Be more explicit about prioritization, and compliance timeframe.
konklone Apr 17, 2015
ff63269
be explicit about keeping apprised of besty practices
konklone Apr 17, 2015
fe39bc6
be explicit about keeping apprised of best practices
konklone Apr 17, 2015
6890052
Merge branch 'changes' of github.com:18F/https into changes
konklone Apr 17, 2015
e2061fe
more changes and language tweaks to match memo
konklone Jun 8, 2015
fbeab38
clarify a bit
konklone Jun 8, 2015
8f614a0
fix a couple typos
konklone Jun 8, 2015
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions pages/everything.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ permalink: /everything/
description: "Today, there is no such thing as insensitive web traffic. By simply always using HTTPS, both people and browsers can make safer assumptions about secure connections."
---

HTTP has become central to today's way of life. Originally invented just for websites, HTTP is now the primary protocol used by computers, tablets, smartphones, and many other devices to communicate over the vast public internet.
HTTP has become central to today's way of life. HTTP is currently the primary protocol for applications used on computers, tablets, smartphones, and many other devices.

As our dependency on the internet has grown, the risk to users' privacy and safety has grown along with it.

Expand All @@ -15,7 +15,7 @@ Today, **there is no such thing as insensitive web traffic**, and public service

When properly configured, HTTPS can provide a fast, secure connection that offers the level of privacy and reliability that users should expect from government web services.

## Privacy by default
## Privacy and integrity by default

By using private connections by default, changed expectations make everyone safer.

Expand All @@ -32,7 +32,7 @@ These changed expectations improve the security of HTTPS on every website. In ot
The internet's standards bodies, web browsers, major tech companies, and the internet community of practice have all come to understand that HTTPS should be the baseline for all web traffic.

* The W3C's Technical Architecture Group has found that [the web should actively prefer secure connections](http://www.w3.org/2001/tag/doc/web-https) and transition entirely to HTTPS.
* The IETF has said that [pervasive monitoring is an attack](https://datatracker.ietf.org/doc/rfc7258/), and the Internet Architecture Board (the IETF's parent organization) recommends that [new protocols use encryption by default](http://www.internetsociety.org/news/internet-society-commends-internet-architecture-board-recommendation-encryption-default).
* The IETF has said that [pervasive monitoring is an attack](https://datatracker.ietf.org/doc/rfc7258/), and the Internet Architecture Board (the IETF's parent organization) recommends that [new protocols use encryption by default](https://www.iab.org/2014/11/14/iab­statement­on­internet­confidentiality/).
* Google has begun to [favor HTTPS websites in search rankings](http://googleonlinesecurity.blogspot.com/2014/08/https-as-ranking-signal_6.html).
* The Chrome and [Firefox](https://groups.google.com/d/msg/mozilla.dev.security/blV0MK4EbEE/i_Vy7sye0WsJ) security teams are working on [gradually marking plain HTTP as non-secure](https://www.chromium.org/Home/chromium-security/marking-http-as-non-secure).

Expand Down
Loading