Difference between revisions of "Timeline of HTTPS adoption"

From Timelines
Jump to: navigation, search
Line 8: Line 8:
 
| 1994 || || Browser || Netspace Navigator || Protocol support || {{w|Netscape Communications}} creates HTTPS for its {{w|Netscape Navigator}} web browser, originally for use with the {{w|Secure Sockets Layer}} (SSL) protocol.
 
| 1994 || || Browser || Netspace Navigator || Protocol support || {{w|Netscape Communications}} creates HTTPS for its {{w|Netscape Navigator}} web browser, originally for use with the {{w|Secure Sockets Layer}} (SSL) protocol.
 
|-
 
|-
−
| 2000 || {{dts|May}} || Standard || RFC 2818 || || RFC 2818 of the {{w|Internet Engineering Task Force}} describes the standard for HTTPS, using HTTP over {{|Transport Layer Security}} (TLS). This is considered a superior, more secure form of HTTPS than HTTPS over SSL.
+
| 2000 || {{dts|May}} || Standard || RFC 2818 || || RFC 2818 of the {{w|Internet Engineering Task Force}} describes the standard for HTTPS, using HTTP over {{w|Transport Layer Security}} (TLS). This is considered a superior, more secure form of HTTPS than HTTPS over SSL.
 
|-
 
|-
 
| 2008 || {{dts|July 24}} || Website || Google (GMail) || Opt-in HTTPS-only || Google adds a setting in GMail for users to always use HTTPS. Even before this, users could (since the inception of GMail) access it securely by explicitly typing https:// in the browser. With the new setting, users who have opted in to it will be redirected from HTTP to HTTPS.<ref>{{cite web|url = https://gmail.googleblog.com/2008/07/making-security-easier.html|title = Making security easier|date = July 24, 2008|accessdate = November 19, 2017|last = Rideout|first = Ariel|publisher = Google}}</ref>
 
| 2008 || {{dts|July 24}} || Website || Google (GMail) || Opt-in HTTPS-only || Google adds a setting in GMail for users to always use HTTPS. Even before this, users could (since the inception of GMail) access it securely by explicitly typing https:// in the browser. With the new setting, users who have opted in to it will be redirected from HTTP to HTTPS.<ref>{{cite web|url = https://gmail.googleblog.com/2008/07/making-security-easier.html|title = Making security easier|date = July 24, 2008|accessdate = November 19, 2017|last = Rideout|first = Ariel|publisher = Google}}</ref>

Revision as of 23:31, 18 November 2017

This timeline describes the gradual increase in websites and clients using HTTPS.

Full timeline

Year Month and date (if available) Entity type Entity name Stage Details
1994 Browser Netspace Navigator Protocol support Netscape Communications creates HTTPS for its Netscape Navigator web browser, originally for use with the Secure Sockets Layer (SSL) protocol.
2000 May Standard RFC 2818 RFC 2818 of the Internet Engineering Task Force describes the standard for HTTPS, using HTTP over Transport Layer Security (TLS). This is considered a superior, more secure form of HTTPS than HTTPS over SSL.
2008 July 24 Website Google (GMail) Opt-in HTTPS-only Google adds a setting in GMail for users to always use HTTPS. Even before this, users could (since the inception of GMail) access it securely by explicitly typing https:// in the browser. With the new setting, users who have opted in to it will be redirected from HTTP to HTTPS.[1]
2010 January 12 Website Google (GMail) Default HTTPS-only Google switches all GMail users to redirect to HTTPS; users can change their setings to not redirect to HTTPS. Previously, the default option for this setting was to not redirect, and users had to explicitly choose the option to redirect HTTP to HTTPS.[2]
2010 June 17 Browser extension HTTPS Everywhere The Electronic Frontier Foundation and The Tor Project, Inc launch HTTPS Everywhere, a Firefox extension, to make Firefox use HTTPS where possible.[3] The extension would evolve over the coming years. As of 2017, it is supported on Firefox, Chrome, and Opera.[4]
2010 June 2 Browser enhancement SSL False Start A Google team comprising Adam Langley, Nagendra Modadugu, and Bodo Moeller propose SSL False Start, a client-side only change to reduce one round-trip from the SSL handshake.[5][6][7] Despite tests showing that it reduces latency by 30%, the effort would be abandoned in April 2012 because of incompatibility with some servers doing early HTTPS termination.[8]
2010 October 14 Proxy/load balancer AWS Elastic Load Balancing AWS Elastic Load Balancing announces support for SSL termination. This means that websites hosted on AWS, behind AWS load balancers, can upload their certificates to the load balancer, and have the load balancer take care of the SSL certificate, so that the servers that receive the actual traffic only have to handle HTTP traffic.[9]
2011 January Website Facebook Opt-in HTTPS-only Facebook begins allowing logged-in users to opt in to have all their Facebook browsing encrypted by HTTPS.[10]
2011 January Standard OCSP stapling RFC 6066, introducing OCSP stapling, is published.[11] OCSP stapling is an alternative approach to the Online Certificate Status Protocol llows the presenter of a certificate to bear the resource cost involved in providing OCSP responses by appending ("stapling") a time-stamped OCSP response signed by the CA to the initial TLS handshake, eliminating the need for clients to contact the certificate authority. RFC 6961 would cover the case of multiple OCSP stapling.[12]
2011 March 15 Website Twitter Opt-in HTTPS-only Twitter begins allowing logged-in users to opt in to have all their Twitter browsing encrypted by HTTPS.[13]
2011 July 15 Proxy/load balancer Nginx GlobalSign, DigiCert, Comodo and NGINX Inc. announce a joint effort to add OCSP-stapling support to Nginx.[14]
2011 October 18 Website Google Search Default HTTPS-only Google makes HTTPS (using SSL) the default option for its search users who are logged in on google.com (its US site; regionally branded sites are not affected).[15][16][17] In particular, webmasters receiving traffic from Google Search will no longer be able to know the search terms that led to a specific visit.[18][19]
2012 February 13 Website Twitter Default HTTPS-only Twitter makes HTTPS the default for all logged-in users.[20][21][22]
2012 March Website Google Search Default HTTPS-only Google makes secure search the default globally for signed-in users. Previously, the change was limited to users on google.com.[23]
2012 November Website Facebook Default HTTPS-only Facebook rolls out its transition to HTTPS by default for all users, beginning with North America.[24][10]
2012 November 19 Standard RFC 6797 Default HTTPS-only The HTTP Strict Transport Security (HSTS) standard is published, after being approved on October 2.[25] The standard allows a website to set a header specifying a time period over which the client must connect to the website only via HTTPS. This protects against protocol downgrade attacks and cookie hijacking, and also avoids the extra latency involved in redirecting HTTP to HTTPS.
2013 August 21 (actual release), August 1 (announcement) Website Wikipedia Default HTTPS-only Wikimedia Foundation turns on HTTPS for all logged-in users (announcement August 1).[26][27]
2014 September 8 Website Reddit Opt-in HTTPS-only Reddit gives logged-in users the option of using the site purely on HTTPS.[28]
2014 November 18 Certificate authority Let's Encrypt Free HTTPS certificates Let's Encrypt, a certificate authority service that can issue HTTPS certificates for three months for free (with some limitations on the types of certificate and the conditions under which certificates can be issued), is publicly announced. The service would issue its first certificate on September 14, 2015, and leave beta on April 12, 2016.
2015 June 12 Website Wikipedia Default HTTPS-only The Wikimedia Foundation publishes a blog post stating that all properties (including Wikipedia) are being switched over to HTTPS; previously, HTTPS was used only for logged-in users. It seems the switch is being made immediately.[29][30][31]
2015 June Website Reddit Default HTTPS-only Reddit switches to HTTPS-only, with users being automatically redirected from HTTP to HTTPS.[32][33]
2017 May 22 Website Stack Overflow Default HTTPS-only Stack Overflow announces that it has migrated to HTTPS, after four years of work on the migration. All other Stack Exchange websites are also moved over to HTTPS.[34][35]

References

  1. ↑ Rideout, Ariel (July 24, 2008). "Making security easier". Google. Retrieved November 19, 2017. 
  2. ↑ Schillace, Sam (January 12, 2010). "Default https access for Gmail". Google. Retrieved November 19, 2017. 
  3. ↑ Eckersley, Peter (June 17, 2010). "Encrypt the Web with the HTTPS Everywhere Firefox Extension". Electronic Frontier Foundation. Retrieved November 19, 2017. 
  4. ↑ "HTTPS Everywhere". Retrieved November 19, 2017. 
  5. ↑ "Transport Layer Security (TLS) False Start". Internet Engineering Task Force. June 2, 2010. Retrieved November 19, 2017. 
  6. ↑ "SSL FalseStart Performance Results". Chromium blog. May 18, 2011. Retrieved November 19, 2017. 
  7. ↑ "Changing HTTPS". Imperial Violet. September 5, 2010. Retrieved November 19, 2017. 
  8. ↑ Goodin, Dan (April 12, 2012). "False Start's sad demise: Google abandons noble attempt to make SSL less painful". Retrieved November 19, 2017. 
  9. ↑ Barr, Jeff (October 14, 2010). "AWS Elastic Load Balancing: Support for SSL Termination". Amazon Web Services. Retrieved November 19, 2017. 
  10. ↑ 10.0 10.1 Constine, Josh (November 18, 2012). "Facebook Could Slow Down A Tiny Bit As It Starts Switching All Users To Secure HTTPS Connections". TechCrunch. Retrieved November 19, 2017. 
  11. ↑ "Transport Layer Security (TLS) Extensions: Extension Definitions". January 1, 2011. Retrieved November 19, 2017. 
  12. ↑ "The Transport Layer Security (TLS) Multiple Certificate Status Request Extension". June 1, 2013. Retrieved November 19, 2017. 
  13. ↑ "Making Twitter more secure: HTTPS". Twitter. March 15, 2011. Retrieved November 19, 2017. 
  14. ↑ "GlobalSign, DigiCert and Comodo Collaborate with NGINX to Improve Online Trust through Enhanced Certificate Revocation Checking, sign a Sponsorship Agreement. New version of the popular NGINX web server to support OCSP-stapling". NGINX, Inc. July 15, 2011. Retrieved November 19, 2017. 
  15. ↑ "Making search more secure". Google. October 18, 2011. Retrieved November 19, 2017. 
  16. ↑ Boulton, Clint (October 18, 2011). "Google Makes HTTPS Encryption Default for Search". eweek. Retrieved November 19, 2017. 
  17. ↑ Sullivan, Danny (October 18, 2011). "Google To Begin Encrypting Searches & Outbound Clicks By Default With SSL Search". Search Engine Land. Retrieved November 19, 2017. 
  18. ↑ "Making search more secure: Accessing search query data in Google Analytics". October 18, 2011. Retrieved November 19, 2017. 
  19. ↑ Sullivan, Danny (October 22, 2011). "Google Puts A Price On Privacy". Retrieved November 19, 2017. 
  20. ↑ "Securing your Twitter experience with HTTPS". Twitter. February 13, 2012. Retrieved November 19, 2017. 
  21. ↑ "Should All Web Traffic Be Encrypted?". Coding Horror. February 23, 2012. Retrieved November 19, 2017. 
  22. ↑ Brinkmann, Martin (February 14, 2012). "Twitter Makes HTTPS Default For Signed In Users". Retrieved November 19, 2017. 
  23. ↑ "Bringing more secure search around the globe". March 5, 2012. Retrieved November 19, 2017. 
  24. ↑ Asthana, Shireesh (November 15, 2012). "Platform Updates: Operation Developer Love". Facebook. Retrieved November 19, 2017. 
  25. ↑ "HTTP Strict Transport Security (HSTS)". November 19, 2012. Retrieved November 19, 2017. 
  26. ↑ Lane, Ryan (August 1, 2013). "The future of HTTPS on Wikimedia projects". Wikimedia Foundation. Retrieved September 25, 2016. 
  27. ↑ Eaton, Kit (August 2, 2013). "After NSA's XKeyscore, Wikipedia Switches To Secure HTTPS. The Wikimedia Foundation has announced it's pushing ahead with plans to secure its online systems due to NSA targeting.". Fast Company. Retrieved September 25, 2016. 
  28. ↑ "Hell, It's About Time – reddit now supports full-site HTTPS". Reddit. September 8, 2014. Retrieved November 19, 2017. 
  29. ↑ Welinder, Yana; Baranetsky, Victoria; Black, Brandon (June 12, 2015). "Securing access to Wikimedia sites with HTTPS". Wikimedia Foundation. Retrieved September 25, 2016. 
  30. ↑ Thomas, Karl (June 15, 2015). "Wikipedia switches to HTTPS by default". WeLiveSecurity. Retrieved September 25, 2016. 
  31. ↑ Farivar, Cyrus (June 15, 2015). "Wikipedia goes all-HTTPS, starting immediately. "We believe that the time for HTTPS by default is now."". ArsTechnica. Retrieved September 25, 2016. 
  32. ↑ Lorenzo Franceschi-Bicchierai (June 17, 2015). "Reddit Switches to Encryption By Default. The internet giant will switch to HTTPS by default by the end of the month.". Vice. Retrieved NOvember 19, 2017.  Check date values in: |access-date= (help)
  33. ↑ "reddit will soon only be available over HTTPS (self.redditdev)". Reddit. June 16, 2015. Retrieved November 19, 2017. 
  34. ↑ Craver, Nick (May 22, 2017). "HTTPS on Stack Overflow: The End of a Long Road". Retrieved November 19, 2017. 
  35. ↑ Taylor, Anita (May 22, 2017). "How Stack Overflow Flipped the Switch on HTTPS". Stack Overflow. Retrieved November 19, 2017. 
Retrieved from "http://timelines.issarice.com/index.php?title=Timeline_of_HTTPS_adoption&oldid=18566"