Development status Active Type Browser extension | Written in JavaScript | |
 | ||
Developer(s) The Tor Project and the Electronic Frontier Foundation Stable release Firefox: 5.2.11, Chrome, Opera: 2017.2.13 / 14 February 2017; 22 days ago (2017-02-14) Repository gitweb.torproject.org/https-everywhere.git | ||
HTTPS Everywhere is a free and open source browser extension for Google Chrome, Mozilla Firefox and Opera, which is developed collaboratively by The Tor Project and the Electronic Frontier Foundation (EFF). It automatically makes websites use the more secure HTTPS connection instead of HTTP, if they support it.
Contents
Development
HTTPS Everywhere was inspired by Google's increased use of HTTPS, and is designed to make HTTPS automatically used whenever possible. The code in part is based on NoScript's HTTP Strict Transport Security implementation, but HTTPS Everywhere is intended to be simpler to use than NoScript. The EFF provides information for users on how to add HTTPS rulesets to HTTPS Everywhere, and information on which websites support HTTPS.
Platform support
A public beta of HTTPS Everywhere for Firefox was released in 2010, and version 1.0 was released in 2011. A beta for Google Chrome was released in February 2012. In 2014, a version was released for Android phones.
SSL Observatory
The SSL Observatory is a feature in HTTPS Everywhere introduced in version 2.0.1 which analyzes public key certificates to determine if certificate authorities have been compromised, and if the user is vulnerable to man-in-the-middle attacks. In 2013, the ICANN Security and Stability Advisory Committee (SSAC) noted that the dataset used by the SSL Observatory often treated intermediate authorities as different entities, thus inflating the number of certificate authorities. The SSAC criticized SSL Observatory for potentially significantly undercounting internal name certificates, and noted that it used a data set from 2010.
Reception
Two studies have recommended building in HTTPS Everywhere functionality into Android browsers. In 2012, Eric Phetteplace described it as "perhaps the best response to Firesheep-style attacks available for any platform". In 2011, Vincent Toubiana and Vincent Verdot pointed out some drawbacks of the HTTPS Everywhere plugin, including that the list of services which support HTTPS needs maintaining, and that some services are redirected to HTTPS even though they are not yet available in HTTPS, not allowing the user of the extension to get to the service.