Difference between revisions of "Timeline of HTTPS adoption"
From Timelines
(→Full timeline) |
|||
| (62 intermediate revisions by 2 users not shown) | |||
| Line 1: | Line 1: | ||
| − | This timeline | + | This timeline gives a history of HTTPS usage and adoption, describing the gradual increase in websites and clients using HTTPS. HTTPS is a secure, encrypted version of HTTP and has been implemented using Sockets Layer (SSL) and Transport Layer Security (TLS). The timeline spans the period from 1994, when HTTPS and SSL were first introduced on {{w|Netscape Navigator}}, to 2019, by which time, thanks to the efforts of Google, Mozilla, and many privacy-focused organizations, HTTPS is ubiquitous and accounts for more traffic than plain, unencrypted HTTP. |
| + | |||
| + | == Sample questions == | ||
| + | |||
| + | * What were the major Internet standards related to HTTPS and when were they defined? (Sort the Full timeline by "Entity type" and look for the group of rows for which this says "Standard") | ||
| + | * When did various leading news sites migrate to HTTPS, and what challenges did they face while migrating? (Sort the Full timeline by "Entity type" and look for the group of rows for which this says" Website"; scan the "Entity name" column to find the news websites or other sites of interest to you; then read the "Details" column and look at the cited reference) | ||
| + | * How can we get quantitative data on how many sites and how much traffic uses HTTPS? (Sort the Full timeline by "Entity type" and look for the rows for which this says "Report" or "Report/Observatory") | ||
== Big picture == | == Big picture == | ||
| Line 26: | Line 32: | ||
| Proxy/load balancer || Server-side || Amazon Web Services || Early SSL termination || Load balancers can manage the SSL/TLS certificates and forward only plain HTTP requests to the servers that have to actually respond to the request. | | Proxy/load balancer || Server-side || Amazon Web Services || Early SSL termination || Load balancers can manage the SSL/TLS certificates and forward only plain HTTP requests to the servers that have to actually respond to the request. | ||
|- | |- | ||
| − | | CDN || Server-side || Amazon CloudFront || Custom SSL || {{w|Content delivery network}}s are used to serve static content at low latency and low cost around the world. CDNs have evolved to allow customers to upload their own SSL certificates for content. | + | | CDN || Server-side || Cloudflare, Amazon CloudFront || Custom SSL || {{w|Content delivery network}}s are used to serve static content at low latency and low cost around the world. CDNs have evolved to allow customers to upload their own SSL certificates for content. |
|- | |- | ||
| Ecosystem || Server-side || Advertising || || Various backend ecosystems that power the technology and monetization of the web, such as advertising, need to support HTTPS in order to complete the transition to HTTPS. | | Ecosystem || Server-side || Advertising || || Various backend ecosystems that power the technology and monetization of the web, such as advertising, need to support HTTPS in order to complete the transition to HTTPS. | ||
|} | |} | ||
| + | |||
| + | === Time period grouping === | ||
| + | |||
| + | {| class="wikitable sortable" | ||
| + | ! Time period !! Qualitative summary of developments | ||
| + | |- | ||
| + | | 1994–2007 || During this period, many of the standards related to HTTPS (HTTP over SSL, HTTP over TLS, SNI) are published as RFCs by the Internet Engineering Task Force. Certificate authorities (CAs) come into being and the CA/Browser Forum is created. A few sites, generally those related to e-commerce, start using HTTPS. | ||
| + | |- | ||
| + | | 2008–2012 || The move to HTTPS begins, with Google taking the lead, and Twitter and Facebook following. Webmail moves first, then search for logged-in users. The general playbook is: HTTPS available, opt-in HTTPS-only, then default HTTPS-only. | ||
| + | |- | ||
| + | | 2013–2014 || The move to HTTPS continues, with laggers in webmail and search catching up on encryption, and Google beginning encryption even for non-logged-in users. Toward the end of this period, Google begins aggressively pushing for the whole web to go HTTPS, first by stating that HTTPS will be a search ranking signal, then by declaring that Chrome eventually intends to mark all plain HTTP sites as not secure. | ||
| + | |- | ||
| + | | 2015–2017 || This is the period when the move to HTTPS intensifies among a number of ordinary websites. Wikipedia, Reddit, Imgur, and some major newspapers and magazines like the ''New York Times'', ''The Guardian'', ''TechCrunch'', and ''Wired'' go HTTPS. Chrome begins the process of marking plain HTTP sites as Not Secure. Let's Encrypt makes it easy and free for people to move to HTTPS. Google and others set up systematic tracking of the proportion of HTTPS usage, and the period ends with a significant increase in HTTPS use. This period also begins a trend of the Chinese government censoring entire websites after they transition to HTTPS, because it can no longer identify and block individual webpages due to encryption. | ||
| + | |- | ||
| + | | 2018–2019 || With Chrome now marking all plain HTTP sites as not secure, most high-traffic sites that had not yet migrated to HTTPS complete their migration. This includes sites like IMDb, BBC, Wikia/Fandom, Fox News, and many others. | ||
| + | |} | ||
| + | |||
== Full timeline == | == Full timeline == | ||
| Line 36: | Line 59: | ||
! Year !! Month and date (if available) !! Entity type !! Entity name !! Stage !! Details | ! Year !! Month and date (if available) !! Entity type !! Entity name !! Stage !! Details | ||
|- | |- | ||
| − | | 1994 || || | + | | 1994 || || Standard || SSL v1.0 || Protocol || {{w|Netscape Communications}} creates HTTPS for its {{w|Netscape Navigator}} web browser, originally for use with the {{w|Secure Sockets Layer}} (SSL) protocol (SSL version 1.0). Due to security issues, this is never officially published. See {{w|Transport Layer Security#SSL_1.0.2C_2.0_and_3.0}}. |
|- | |- | ||
| − | | | + | | 1995 || {{dts|February}} || Standard || SSL v2.0 || Protocol || SSL v2.0 is released. It has a number of security flaws. See [[w:Transport Layer Security#SSL_1.0.2C_2.0_and_3.0]]. |
|- | |- | ||
| − | | | + | | 1995 || {{dts|July}} || Server hosting || Netscape || Commercial offering || ''Fortune'' reports that Netscape charges $1,495 for a server and $5,000 for a server with secure communication (i.e., serving traffic over HTTPS).<ref>{{cite web|url = http://fortune.com/2012/02/05/the-rise-of-netscape/|title = The rise of Netscape|last = Sprout|first = Alison|date = July 1, 1995|accessdate = March 11, 2018}}</ref><ref name=jeff>{{cite web|url = https://www.jefftk.com/p/history-of-https-usage|title = History of HTTPS Usage|date = March 8, 2018|accessdate = March 11, 2018|last = Kaufman|first = Jeff}}</ref> |
|- | |- | ||
| − | | | + | | 1995 || {{dts|September 19}} || Bugfix || || Vulnerability exploit || Two graduate students at the University of California, Berkeley discover a security vulnerability with Netscape Navigator, that also affects HTTPS sites and risks credit card transactions being eavesdropped on.<ref>{{cite web|url = http://www.cnn.com/TECH/9509/netscape_flaw/index.html|title = Netscape: Internet security flaw can be fixed.|date = September 19, 1995|accessdate = March 11, 2018}}</ref><ref>{{cite web|url = http://query.nytimes.com/gst/fullpage.html?res=990CEFDC1131F935A25753C1A963958260&pagewanted=all|title = The New Watchdogs of Digital Commerce|date = October 16, 1995|accessdate = March 11, 2018|publisher = ''New York Times''|last = Markoff|first = John}}</ref><ref name=jeff/> |
|- | |- | ||
| − | | | + | | 1996 || || Standard || SSL v3.0 || Protocol || SSL v3.0 is released and its specification is drafted. IETF would publish this draft as a historical document in 2011.<ref>{{Cite web|url = https://tools.ietf.org/html/rfc6101|title = The Secure Sockets Layer (SSL) Protocol Version 3.0|date = August 1, 2011|accessdate = November 23, 2017|publisher = [[Internet Engineering Task Force]]}}</ref> |
|- | |- | ||
| − | | 2010 || {{dts|January 12}} || Webmail|| Google (Gmail) || Default HTTPS-only || Google switches all Gmail users to redirect to HTTPS; users can change their setings to not redirect to HTTPS. Previously, the default option for this setting was to not redirect, and users had to explicitly choose the option to redirect HTTP to HTTPS.<ref>{{cite web|url = https://gmail.googleblog.com/2010/01/default-https-access-for-gmail.html|title = Default https access for Gmail|date = January 12, 2010|accessdate = November 19, 2017|publisher = Google|last = Schillace|first = Sam}}</ref> | + | | 1999 || {{dts|January}} || Standard || TLS 1.0 || Protocol || Version 1.0 of the {{w|Transport Layer Security}} (TLS) protocol is published as RFC 2246. TLS would replace SSL as the protocol used for HTTPS.<ref>{{cite web|url = https://tools.ietf.org/html/rfc2246|title = The TLS Protocol Version 1.0|date = January 1, 1999|accessdate = November 23, 2017|publisher = Internet Engineering Task Force}}</ref> |
| + | |- | ||
| + | | 2000 || {{dts|May}} || Standard || HTTP over TLS || Protocol || RFC 2818 of the {{w|Internet Engineering Task Force}} (IETF) describes the standard for HTTPS, using HTTP over {{w|Transport Layer Security}} (TLS).<ref>{{cite web|url = https://tools.ietf.org/html/rfc2818|title = HTTP Over TLS|date = May 1, 2000|accessdate = November 23, 2017|publisher = Internet Engineering Task Force}}</ref> | ||
| + | |- | ||
| + | | 2001 || {{dts|July 26}} || || {{w|Wikipedia}} || || {{w|HTTPS}} initial entry is created on {{w|English Wikipedia}}.<ref>{{cite web |title=HTTPS: Revision history |url=https://en.wikipedia.org/w/index.php?title=HTTPS&dir=prev&action=history |website=en.wikipedia.org |accessdate=1 March 2020}}</ref> | ||
| + | |- | ||
| + | | 2003 || {{dts|June}} || Standard || SNI || Protocol || RFS 3546 of the IETF describes a number of augmentations to TLS, including {{w|Server Name Indication}} (SNI).<ref>{{cite web|url = https://tools.ietf.org/html/rfc3546|title = Transport Layer Security (TLS) Extensions|date = June 1, 2003|accessdate = November 20, 2017|publisher = Internet Engineering Task Force}}</ref> | ||
| + | |- | ||
| + | | 2004 || {{dts|April 1}} || Webmail || Google (Gmail) || HTTPS availability || Gmail, Google's web-based email service, launches. The service is available over HTTPS right from the time of launch.<ref name=jeff/> | ||
| + | |- | ||
| + | | 2004 || {{dts|April 14}} || Bugfix || || Vulnerability exploit || Microsoft issues a fix for a bug in its SSL library that allows remote attackers to gain control of unpatched Windows 2000 and Windows NT4 servers offering encrypted services over the internet.<ref>{{cite web|url = https://news.netcraft.com/archives/2004/04/14/microsoft_ssl_vulnerability_gives_attackers_opportunity_to_gain_control_of_leading_banking_sites.html|title = Microsoft SSL Vulnerability gives attackers opportunity to gain control of leading banking sites|date = April 14, 2004|accessdate = March 11, 2018|publisher = Netcraft}}</ref> | ||
| + | |- | ||
| + | |2005 || {{dts|April 20}} || || Microsoft || || A blog post by {{w|Microsoft}} argues that using non-HTTPS login pages is insecure, even if the form submission is to a HTTPS page.<ref>{{cite web|url = https://blogs.msdn.microsoft.com/ie/2005/04/20/tls-and-ssl-in-the-real-world/|title = TLS and SSL in the real world|date = April 20, 2005|accessdate = March 11, 2018}}</ref><ref name=jeff/> | ||
| + | |- | ||
| + | | 2005 || || || || || The {{w|CA/Browser Forum}} is founded. It is a voluntary consortium of certification authorities, vendors of Internet browser software, operating systems, and other PKI-enabled applications that promulgates industry guidelines governing the issuance and management of X.509 v.3 digital certificates that chain to a trust anchor embedded in such applications. | ||
| + | |- | ||
| + | | 2006 || {{dts|April}} || Standard || TLS 1.1 || Protocol || RFC 4346 defines TLS 1.1, the next version of TLS after TLS 1.0.<ref>{{cite web|url = https://tools.ietf.org/html/rfc4346|title = The Transport Layer Security (TLS) Protocol Version 1.1|date = April 1, 2006|accessdate = November 23, 2017|publisher = Internet Engineering Task Force}}</ref> | ||
| + | |- | ||
| + | | 2008 || {{dts|July 24}} || Webmail || Google (Gmail) || Opt-in HTTPS-only || Google adds a setting in Gmail for users to always use HTTPS. Even before this, users could (since the inception of Gmail) access it securely by explicitly typing https:// in the browser. With the new setting, users who have opted in to it will be redirected from HTTP to HTTPS.<ref>{{cite web|url = https://gmail.googleblog.com/2008/07/making-security-easier.html|title = Making security easier|date = July 24, 2008|accessdate = November 19, 2017|last = Rideout|first = Ariel|publisher = Google}}</ref><ref name=jeff/> | ||
| + | |- | ||
| + | | 2008 || {{dts|August}} || Standard || TLS 1.2 || Protocol || RFC 5246 defines TLS 1.2, the next version of TLS after TLS 1.1.<ref>{{Cite web|url = https://tools.ietf.org/html/rfc5246|title = The Transport Layer Security (TLS) Protocol Version 1.2|date = August 1, 2008|accessdate = November 23, 2017|publisher = Internet Engineering Task Force}}</ref> | ||
| + | |- | ||
| + | | 2010 || {{dts|January 12}} || Webmail|| Google (Gmail) || Default HTTPS-only || Google switches all Gmail users to redirect to HTTPS; users can change their setings to not redirect to HTTPS. Previously, the default option for this setting was to not redirect, and users had to explicitly choose the option to redirect HTTP to HTTPS.<ref>{{cite web|url = https://gmail.googleblog.com/2010/01/default-https-access-for-gmail.html|title = Default https access for Gmail|date = January 12, 2010|accessdate = November 19, 2017|publisher = Google|last = Schillace|first = Sam}}</ref><ref name=jeff/> | ||
| + | |- | ||
| + | | 2010 || {{dts|May 21}} || Search engine || Google Search || HTTPS availability || Google makes search available on SSL at https://www.google.com. However, on June 25, they announced that they are moving encrypted search to https://encrypted.google.com because of challenges reported by school districts.<ref>{{cite web|url = https://googleblog.blogspot.com/2010/05/search-more-securely-with-encrypted.html|title = Search more securely with encrypted Google web search|date = May 21, 2010|accessdate = March 11, 2018|publisher = Google Official Blog|last = Roseman|first = Evan}}</ref><ref name=jeff/> | ||
|- | |- | ||
| 2010 || {{dts|June 17}} || Browser extension || HTTPS Everywhere || Security improvement || The {{w|Electronic Frontier Foundation}} and {{w|The Tor Project, Inc}} launch {{w|HTTPS Everywhere}}, a {{w|Firefox}} extension, to make Firefox use HTTPS where possible.<ref>{{cite web|url = https://www.eff.org/deeplinks/2010/06/encrypt-web-https-everywhere-firefox-extension|title = Encrypt the Web with the HTTPS Everywhere Firefox Extension|last = Eckersley|first = Peter|date = June 17, 2010|accessdate = November 19, 2017|publisher = Electronic Frontier Foundation}}</ref> The extension would evolve over the coming years. As of 2017, it is supported on Firefox, Chrome, and Opera.<ref name=https-everywhere>{{cite web|url = https://www.eff.org/https-everywhere|title = HTTPS Everywhere|accessdate = November 19, 2017}}</ref> | | 2010 || {{dts|June 17}} || Browser extension || HTTPS Everywhere || Security improvement || The {{w|Electronic Frontier Foundation}} and {{w|The Tor Project, Inc}} launch {{w|HTTPS Everywhere}}, a {{w|Firefox}} extension, to make Firefox use HTTPS where possible.<ref>{{cite web|url = https://www.eff.org/deeplinks/2010/06/encrypt-web-https-everywhere-firefox-extension|title = Encrypt the Web with the HTTPS Everywhere Firefox Extension|last = Eckersley|first = Peter|date = June 17, 2010|accessdate = November 19, 2017|publisher = Electronic Frontier Foundation}}</ref> The extension would evolve over the coming years. As of 2017, it is supported on Firefox, Chrome, and Opera.<ref name=https-everywhere>{{cite web|url = https://www.eff.org/https-everywhere|title = HTTPS Everywhere|accessdate = November 19, 2017}}</ref> | ||
| Line 62: | Line 109: | ||
| 2011 || {{dts|January}} || Website || Facebook || Opt-in HTTPS-only || {{w|Facebook}} begins allowing logged-in users to opt in to have all their Facebook browsing encrypted by HTTPS.<ref name=facebook-https-default>{{cite web|url = https://techcrunch.com/2012/11/18/facebook-https/|title = Facebook Could Slow Down A Tiny Bit As It Starts Switching All Users To Secure HTTPS Connections|last = Constine|first = Josh|date = November 18, 2012|accessdate = November 19, 2017|publisher = ''TechCrunch''}}</ref> | | 2011 || {{dts|January}} || Website || Facebook || Opt-in HTTPS-only || {{w|Facebook}} begins allowing logged-in users to opt in to have all their Facebook browsing encrypted by HTTPS.<ref name=facebook-https-default>{{cite web|url = https://techcrunch.com/2012/11/18/facebook-https/|title = Facebook Could Slow Down A Tiny Bit As It Starts Switching All Users To Secure HTTPS Connections|last = Constine|first = Josh|date = November 18, 2012|accessdate = November 19, 2017|publisher = ''TechCrunch''}}</ref> | ||
|- | |- | ||
| − | | 2011 || {{dts|January}} || Standard || OCSP stapling || || RFC 6066, introducing OCSP stapling, is published.<ref>{{cite web|url = https://tools.ietf.org/html/rfc6066|title = Transport Layer Security (TLS) Extensions: Extension Definitions|date = January 1, 2011|accessdate = November 19, 2017}}</ref> OCSP stapling is an alternative approach to the {{W|Online Certificate Status Protocol}} | + | | 2011 || {{dts|January}} || Standard || OCSP stapling || Protocol || RFC 6066, introducing OCSP stapling, is published.<ref>{{cite web|url = https://tools.ietf.org/html/rfc6066|title = Transport Layer Security (TLS) Extensions: Extension Definitions|date = January 1, 2011|accessdate = November 19, 2017}}</ref> OCSP stapling is an alternative approach to the {{W|Online Certificate Status Protocol}} that allows the presenter of a certificate to bear the resource cost involved in providing OCSP responses by appending ("stapling") a time-stamped OCSP response signed by the CA to the initial TLS handshake, eliminating the need for clients to contact the certificate authority. RFC 6961 would cover the case of multiple OCSP stapling.<ref>{{cite web|url = https://tools.ietf.org/html/rfc6961|title = The Transport Layer Security (TLS) Multiple Certificate Status Request Extension|date = June 1, 2013|accessdate = November 19, 2017}}</ref> |
|- | |- | ||
| 2011 || {{dts|March 15}} || Website || Twitter || Opt-in HTTPS-only || {{w|Twitter}} begins allowing logged-in users to opt in to have all their Twitter browsing encrypted by HTTPS.<ref name=twitter-https-optin>{{cite web|url = https://blog.twitter.com/official/en_us/a/2011/making-twitter-more-secure-https.html|title = Making Twitter more secure: HTTPS|date = March 15, 2011|accessdate = November 19, 2017|publisher = Twitter}}</ref> | | 2011 || {{dts|March 15}} || Website || Twitter || Opt-in HTTPS-only || {{w|Twitter}} begins allowing logged-in users to opt in to have all their Twitter browsing encrypted by HTTPS.<ref name=twitter-https-optin>{{cite web|url = https://blog.twitter.com/official/en_us/a/2011/making-twitter-more-secure-https.html|title = Making Twitter more secure: HTTPS|date = March 15, 2011|accessdate = November 19, 2017|publisher = Twitter}}</ref> | ||
| Line 68: | Line 115: | ||
| 2011 || {{dts|July 15}} || Proxy/load balancer || Nginx || || GlobalSign, DigiCert, Comodo and NGINX Inc. announce a joint effort to add OCSP-stapling support to Nginx.<ref>{{cite web|url = https://www.nginx.com/press/globalsign-digicert-and-comodo-collaborate-nginx-improve-online/|title = GlobalSign, DigiCert and Comodo Collaborate with NGINX to Improve Online Trust through Enhanced Certificate Revocation Checking, sign a Sponsorship Agreement. New version of the popular NGINX web server to support OCSP-stapling|date = July 15, 2011|accessdate = November 19, 2017|publisher = NGINX, Inc.}}</ref> | | 2011 || {{dts|July 15}} || Proxy/load balancer || Nginx || || GlobalSign, DigiCert, Comodo and NGINX Inc. announce a joint effort to add OCSP-stapling support to Nginx.<ref>{{cite web|url = https://www.nginx.com/press/globalsign-digicert-and-comodo-collaborate-nginx-improve-online/|title = GlobalSign, DigiCert and Comodo Collaborate with NGINX to Improve Online Trust through Enhanced Certificate Revocation Checking, sign a Sponsorship Agreement. New version of the popular NGINX web server to support OCSP-stapling|date = July 15, 2011|accessdate = November 19, 2017|publisher = NGINX, Inc.}}</ref> | ||
|- | |- | ||
| − | | 2011 || {{dts|October 18}} || Search engine || Google Search || Default HTTPS-only || Google makes HTTPS (using SSL) the default option for its search users who are logged in on google.com (its US site; regionally branded sites are not affected).<ref>{{cite web|url = https://googleblog.blogspot. | + | | 2011 || {{dts|October 18}} || Search engine || Google Search || Default HTTPS-only || Google makes HTTPS (using SSL) the default option for its search users who are logged in on google.com (its US site; regionally branded sites are not affected).<ref>{{cite web|url = https://googleblog.blogspot.com/2011/10/making-search-more-secure.html|title = Making search more secure|date = October 18, 2011|accessdate = November 19, 2017|publisher = Google}}</ref><ref>{{cite web|url = http://www.eweek.com/security/google-makes-https-encryption-default-for-search|title = Google Makes HTTPS Encryption Default for Search|last = Boulton|first = Clint|date = October 18, 2011|accessdate = November 19, 2017|publisher = eweek}}</ref><ref>{{cite web|url = https://searchengineland.com/google-to-begin-encrypting-searches-outbound-clicks-by-default-97435|title = Google To Begin Encrypting Searches & Outbound Clicks By Default With SSL Search|last = Sullivan|first = Danny|date = October 18, 2011|accessdate = November 19, 2017|publisher = Search Engine Land}}</ref> In particular, webmasters receiving traffic from Google Search will no longer be able to know the search terms that led to a specific visit.<ref>{{Cite web|url = https://analytics.googleblog.com/2011/10/making-search-more-secure-accessing.html|title = Making search more secure: Accessing search query data in Google Analytics|date = October 18, 2011|accessdate = November 19, 2017}}</ref><ref>{{cite web|url = https://searchengineland.com/google-puts-a-price-on-privacy-98029|title = Google Puts A Price On Privacy|last = Sullivan|first = Danny|date = October 22, 2011|accessdate = November 19, 2017}}</ref> |
|- | |- | ||
| 2012 || {{dts|February 13}} || Website || Twitter || Default HTTPS-only || Twitter makes HTTPS the default for all logged-in users.<ref>{{cite web|url = https://blog.twitter.com/official/en_us/a/2012/securing-your-twitter-experience-with-https.html|title = Securing your Twitter experience with HTTPS|date = February 13, 2012|accessdate = November 19, 2017|publisher = Twitter}}</ref><ref>{{cite web|url = https://blog.codinghorror.com/should-all-web-traffic-be-encrypted/|title = Should All Web Traffic Be Encrypted?|date = February 23, 2012|accessdate = November 19, 2017|publisher = Coding Horror}}</ref><ref>{{cite web|url = https://www.ghacks.net/2012/02/14/twitter-makes-https-default-for-signed-in-users/|title = Twitter Makes HTTPS Default For Signed In Users|last = Brinkmann|first = Martin|date = February 14, 2012|accessdate = November 19, 2017}}</ref> | | 2012 || {{dts|February 13}} || Website || Twitter || Default HTTPS-only || Twitter makes HTTPS the default for all logged-in users.<ref>{{cite web|url = https://blog.twitter.com/official/en_us/a/2012/securing-your-twitter-experience-with-https.html|title = Securing your Twitter experience with HTTPS|date = February 13, 2012|accessdate = November 19, 2017|publisher = Twitter}}</ref><ref>{{cite web|url = https://blog.codinghorror.com/should-all-web-traffic-be-encrypted/|title = Should All Web Traffic Be Encrypted?|date = February 23, 2012|accessdate = November 19, 2017|publisher = Coding Horror}}</ref><ref>{{cite web|url = https://www.ghacks.net/2012/02/14/twitter-makes-https-default-for-signed-in-users/|title = Twitter Makes HTTPS Default For Signed In Users|last = Brinkmann|first = Martin|date = February 14, 2012|accessdate = November 19, 2017}}</ref> | ||
| Line 82: | Line 129: | ||
| 2012 || {{dts|November 19}} || Standard || RFC 6797 || Default HTTPS-only || The {{w|HTTP Strict Transport Security}} (HSTS) standard is published, after being approved on October 2.<ref>{{cite web|url = https://tools.ietf.org/html/rfc6797|title = HTTP Strict Transport Security (HSTS)|date = November 19, 2012|accessdate = November 19, 2017}}</ref> The standard allows a website to set a header specifying a time period over which the client must connect to the website only via HTTPS. This protects against {{w|protocol downgrade attack}}s and {{w|cookie hijacking}}, and also avoids the extra latency involved in redirecting HTTP to HTTPS. | | 2012 || {{dts|November 19}} || Standard || RFC 6797 || Default HTTPS-only || The {{w|HTTP Strict Transport Security}} (HSTS) standard is published, after being approved on October 2.<ref>{{cite web|url = https://tools.ietf.org/html/rfc6797|title = HTTP Strict Transport Security (HSTS)|date = November 19, 2012|accessdate = November 19, 2017}}</ref> The standard allows a website to set a header specifying a time period over which the client must connect to the website only via HTTPS. This protects against {{w|protocol downgrade attack}}s and {{w|cookie hijacking}}, and also avoids the extra latency involved in redirecting HTTP to HTTPS. | ||
|- | |- | ||
| − | | 2013 || {{dts|February}} || || || || The {{Certificate Authority Security Council}} is founded by the seven largest [[w:certificate authority|certificate authorities]]: {{w|Comodo}}, {{w|Symantec}}, {{w|Trend Micro}}, {{w|DigiCert | + | | 2013 || {{dts|February}} || || || || The {{w|Certificate Authority Security Council}} is founded by the seven largest [[w:certificate authority|certificate authorities]]: {{w|Comodo}}, {{w|Symantec}}, {{w|Trend Micro}}, {{w|DigiCert}}, {{w|Entrust}}, {{w|GlobalSign}}, and {{w|GoDaddy}}. |
|- | |- | ||
| 2013 || {{dts|August 21}} (actual release), August 1 (announcement) || Website || Wikipedia || Default HTTPS-only || Wikimedia Foundation turns on HTTPS for all logged-in users (announcement August 1).<ref>{{cite web|url = https://blog.wikimedia.org/2013/08/01/future-https-wikimedia-projects/|title = The future of HTTPS on Wikimedia projects|date = August 1, 2013|accessdate = September 25, 2016|publisher = Wikimedia Foundation|last = Lane|first = Ryan}}</ref><ref>{{cite web|url = https://www.fastcompany.com/3015199/the-code-war/after-nsas-xkeyscore-wikipedia-switches-to-secure-https|title = After NSA's XKeyscore, Wikipedia Switches To Secure HTTPS. The Wikimedia Foundation has announced it's pushing ahead with plans to secure its online systems due to NSA targeting.|last = Eaton|first = Kit|publisher = ''Fast Company''|date = August 2, 2013|accessdate = September 25, 2016}}</ref> | | 2013 || {{dts|August 21}} (actual release), August 1 (announcement) || Website || Wikipedia || Default HTTPS-only || Wikimedia Foundation turns on HTTPS for all logged-in users (announcement August 1).<ref>{{cite web|url = https://blog.wikimedia.org/2013/08/01/future-https-wikimedia-projects/|title = The future of HTTPS on Wikimedia projects|date = August 1, 2013|accessdate = September 25, 2016|publisher = Wikimedia Foundation|last = Lane|first = Ryan}}</ref><ref>{{cite web|url = https://www.fastcompany.com/3015199/the-code-war/after-nsas-xkeyscore-wikipedia-switches-to-secure-https|title = After NSA's XKeyscore, Wikipedia Switches To Secure HTTPS. The Wikimedia Foundation has announced it's pushing ahead with plans to secure its online systems due to NSA targeting.|last = Eaton|first = Kit|publisher = ''Fast Company''|date = August 2, 2013|accessdate = September 25, 2016}}</ref> | ||
| Line 96: | Line 143: | ||
| 2014 || {{dts|January 22}} || Search engine || Yahoo! || Default HTTPS-only || Yahoo! Search makes HTTPS-only the default. The change is initially rolled out on yahoo.com, but is expected to be rolled out to other regions as well.<ref>{{cite web|url = https://marketingland.com/yahoo-makes-secure-search-default-71308|title = Yahoo Makes Secure Search The Default|last = Sullivan|first = Danny|date = January 22, 2014|accessdate = November 20, 2017|publisher = MarketingLand}}</ref> | | 2014 || {{dts|January 22}} || Search engine || Yahoo! || Default HTTPS-only || Yahoo! Search makes HTTPS-only the default. The change is initially rolled out on yahoo.com, but is expected to be rolled out to other regions as well.<ref>{{cite web|url = https://marketingland.com/yahoo-makes-secure-search-default-71308|title = Yahoo Makes Secure Search The Default|last = Sullivan|first = Danny|date = January 22, 2014|accessdate = November 20, 2017|publisher = MarketingLand}}</ref> | ||
|- | |- | ||
| − | | 2014 || {{dts|January}} || Website || YouTube || Some move to HTTPS || YouTube begins sending traffic over HTTPS, significantly increasing the volume of traffic sent on the web via HTTPS. By September 2014, 50% of YouTube traffic would be sent via HTTPS.<ref name=naylor>{{cite web|url = https://davidtnaylor.com/CostOfTheS.pdf|title = The Cost of the “S” in HTTPS|last = Naylor|first = David|last2 = Finamore|first2 = Alessandro| | + | | 2014 || {{dts|January}} || Website || YouTube || Some move to HTTPS || YouTube begins sending traffic over HTTPS, significantly increasing the volume of traffic sent on the web via HTTPS. By September 2014, 50% of YouTube traffic would be sent via HTTPS.<ref name=naylor>{{cite web|url = https://davidtnaylor.com/CostOfTheS.pdf|title = The Cost of the “S” in HTTPS|last = Naylor|first = David|last2 = Finamore|first2 = Alessandro|last3 = Leontiadis|first3 = Ilias|last4 = Grunenberger|first4 = Yan|last5 = Mellia|first5 = Marco|last6 = Munafo|first6 = Maurizio|last7 = Papagiannaki|first7 = Konstantina|last8 = Steenkiste|first8 = Peter}}</ref> |
| + | |- | ||
| + | | 2014 || {{dts|February 3}} || Website || Tumblr || Opt-in HTTPS-only || Tumblr gives blog owners the option of switching their blogs to HTTPS-only. NOTE: Unlike some other opt-in HTTPS-only implementations, the option is controlled by website owners rather than website visitors.<ref>{{cite web|url = https://staff.tumblr.com/post/75482980993/you-can-now-take-extra-precaution-against-hackers|title = You can now take extra precaution against hackers and snoops by enabling SSL security on your Tumblr Dashboard.|publisher = Tumblr|date = February 3, 2014|accessdate = April 13, 2019}}</ref> Internet security commentators feel that Tumblr didn't go far enough, and should have switched to default HTTPS-only.<ref>{{cite web|url = https://www.cnet.com/news/tumblr-activates-ssl-but-with-a-catch/|title = Tumblr activates SSL, but with a catch. Tumblr blog owners can encrypt all visits to their sites, as long as they opt in. Why didn't Yahoo just make SSL the default setting?|date = February 3, 2014|accessdate = April 13, 2019}}</ref> | ||
|- | |- | ||
| 2014 || {{dts|March 5}} || CDN || Amazon CloudFront || SNI custom SSL, HTTPS redirection || Amazon CloudFront announces support for customers to use their own SSL certificates through the implementation of {{w|Server Name Indication}}, as well as HTTP to HTTPS redirection (via 301 redirect). | | 2014 || {{dts|March 5}} || CDN || Amazon CloudFront || SNI custom SSL, HTTPS redirection || Amazon CloudFront announces support for customers to use their own SSL certificates through the implementation of {{w|Server Name Indication}}, as well as HTTP to HTTPS redirection (via 301 redirect). | ||
| + | |- | ||
| + | | 2014 || c.{{dts|March 22}} || {{w|Email}} service || Gmail || HTTPS adoption || {{w|Gmail}} goes 100% HTTPS.<ref name="ss"/> | ||
| + | |- | ||
| + | | 2014 || {{dts|June 5}} || Website || WordPress || Default HTTPS-only || {{w|Automattic}}, the parent company of wordpress.com, announces that all wordpress.com subdomains will be moved to default HTTPS-only by the end of 2014.<ref>{{cite web|url = https://en.blog.wordpress.com/2014/06/05/reset-the-net/|title = Reset the Net. If we properly encrypt our sites and devices, we can make mass surveillance much more difficult. We’ll be serving pages only over SSL for all *.wordpress.com subdomains by the end of the year.|last = Siemenski|first = Paul|date = June 5, 2014|accessdate = December 1, 2019|publisher = The WordPress.com Blog}}</ref> | ||
|- | |- | ||
| 2014 || {{dts|July 29}} || App || Instagram || Default HTTPS-only || In response to reports about a zero-day security vulnerability, Instagram co-founder {{w|Mike Krieger}} reveals that the app is being moved over to HTTPS, with some parts of the app already 100% HTTPS.<ref>{{cite web|url = https://www.theinquirer.net/inquirer/news/2357779/instagram-to-use-https-following-discovery-of-gaping-security-hole-in-ios-app|title = Instagram to use HTTPS following discovery of gaping security hole in iOS app. Security expert warns users should not use the app until a patch is released|date = July 29, 2014|accessdate = November 19, 2017|publisher = The Inquirer}}</ref> | | 2014 || {{dts|July 29}} || App || Instagram || Default HTTPS-only || In response to reports about a zero-day security vulnerability, Instagram co-founder {{w|Mike Krieger}} reveals that the app is being moved over to HTTPS, with some parts of the app already 100% HTTPS.<ref>{{cite web|url = https://www.theinquirer.net/inquirer/news/2357779/instagram-to-use-https-following-discovery-of-gaping-security-hole-in-ios-app|title = Instagram to use HTTPS following discovery of gaping security hole in iOS app. Security expert warns users should not use the app until a patch is released|date = July 29, 2014|accessdate = November 19, 2017|publisher = The Inquirer}}</ref> | ||
| Line 105: | Line 158: | ||
|- | |- | ||
| 2014 || {{dts|September 8}} || Website || Reddit || Opt-in HTTPS-only || Reddit gives logged-in users the option of using the site purely on HTTPS.<ref>{{cite web|url = https://redditblog.com/2014/09/08/hell-its-about-time-reddit-now-supports-full-site-https/|title = Hell, It’s About Time – reddit now supports full-site HTTPS|date = September 8, 2014|accessdate = November 19, 2017|publisher = Reddit}}</ref> | | 2014 || {{dts|September 8}} || Website || Reddit || Opt-in HTTPS-only || Reddit gives logged-in users the option of using the site purely on HTTPS.<ref>{{cite web|url = https://redditblog.com/2014/09/08/hell-its-about-time-reddit-now-supports-full-site-https/|title = Hell, It’s About Time – reddit now supports full-site HTTPS|date = September 8, 2014|accessdate = November 19, 2017|publisher = Reddit}}</ref> | ||
| + | |- | ||
| + | | 2014 || {{dts|September 29}} || CDN || Cloudflare || Default HTTPS-only || Cloudflare announces that it is rolling out universal SSL for all its users. This only affects connections to Cloudflare, and does not focre websites to upgrade their main site to HTTPS; however, all website owners are encouraged to upgrade their sites as well. In a blog post, Cloudflare CEO Matthew Prince explains the transition and the motivation behind it.<ref>{{cite web|url = https://blog.cloudflare.com/introducing-universal-ssl/|title = Introducing Universal SSL|date = September 29, 2014|accessdate = December 1, 2019|publisher = Cloudflare|last = Prince|first = Matthew}}</ref> | ||
|- | |- | ||
| 2014 || {{dts|November 18}} || Certificate authority || Let's Encrypt || Free HTTPS certificates || {{w|Let's Encrypt}}, a certificate authority service that can issue HTTPS certificates for three months for free (with some limitations on the types of certificate and the conditions under which certificates can be issued), is publicly announced. The service would issue its first certificate on September 14, 2015, and leave beta on April 12, 2016. | | 2014 || {{dts|November 18}} || Certificate authority || Let's Encrypt || Free HTTPS certificates || {{w|Let's Encrypt}}, a certificate authority service that can issue HTTPS certificates for three months for free (with some limitations on the types of certificate and the conditions under which certificates can be issued), is publicly announced. The service would issue its first certificate on September 14, 2015, and leave beta on April 12, 2016. | ||
| Line 119: | Line 174: | ||
|- | |- | ||
| 2015 || {{dts|April 13}} || Browser || Firefox || Security warning || Mozilla announces plans to deprecate plain HTTP in their browser, Firefox.<ref>{{cite web|url = https://groups.google.com/forum/#!topic/mozilla.dev.platform/xaGffxAM-hs%5B1-25%5D|title = Intent to deprecate: Insecure HTTP|last = Barnes|first = Richard|date = April 13, 2015|accessdate = November 20, 2017}}</ref><ref>{{cite web|url = http://www.thesempost.com/mozilla-deprecate-http-firefox/|title = Mozilla Announces Plans to Deprecate HTTP in Firefox|date = April 16, 2015|accessdate = November 20, 2017|publisher = The SEM Post}}</ref> | | 2015 || {{dts|April 13}} || Browser || Firefox || Security warning || Mozilla announces plans to deprecate plain HTTP in their browser, Firefox.<ref>{{cite web|url = https://groups.google.com/forum/#!topic/mozilla.dev.platform/xaGffxAM-hs%5B1-25%5D|title = Intent to deprecate: Insecure HTTP|last = Barnes|first = Richard|date = April 13, 2015|accessdate = November 20, 2017}}</ref><ref>{{cite web|url = http://www.thesempost.com/mozilla-deprecate-http-firefox/|title = Mozilla Announces Plans to Deprecate HTTP in Firefox|date = April 16, 2015|accessdate = November 20, 2017|publisher = The SEM Post}}</ref> | ||
| + | |- | ||
| + | | 2015 || {{dts|May 19}} || Website || Wikipedia || Site-wide censorship due to HTTPS transition || Likely starting around this day (judging from traffic volume), the Chinese government blocks Chinese Wikipedia.<ref>{{cite web|url = https://wikimedia.org/api/rest_v1/metrics/legacy/pagecounts/aggregate/zh.wikipedia/desktop-site/daily/2015050100/2015053123|title = Aggregate page counts for traffic to Chinese Wikipedia for May 2015|accessdate = April 13, 2019}}</ref> The rationale is that, with Wikipedia's coming transition to HTTPS-only, the Chinese government will not be able to identify what page on the site a user is visiting, so blocking the whole site is the only way to implement the goal of blocking specific pages with politically sensitive content. See [[w:Censorship of Wikipedia#China]] for more details. | ||
|- | |- | ||
| 2015 || {{dts|June 8}} || Website || United States government || Default HTTPS-only || The White House {{w|Office of Management and Budget}} issues the HTTPS-Only Standard directive requiring that all United States federal government websites provide service only via HTTPS, with a deadline of end of 2016.<ref>{{Cite web|url = https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2015/m-15-13.pdf|title = Policy to Require Secure Connections across Federal Websites and Web Services|date = June 8, 2015|last = Scott|first = Tony|accessdate = November 20, 2017}}</ref><ref>{{cite web|url = https://obamawhitehouse.archives.gov/blog/2015/06/08/https-everywhere-government|title = HTTPS-Everywhere for Government|last = Scott|first = Tony|date = June 8, 2015|accessdate = November 20, 2017|publisher = Obama White House Archives}}</ref><ref>{{cite web|url = https://www.computerworld.com/article/2933172/government-it/us-to-require-https-for-all-government-websites.html|title = US to require HTTPS for all government websites. All public sites will be required to use the protocol by the end of 2016|last = Williams|first = Martyn|date = June 8, 2015|accessdate = November 20, 2017}}</ref> | | 2015 || {{dts|June 8}} || Website || United States government || Default HTTPS-only || The White House {{w|Office of Management and Budget}} issues the HTTPS-Only Standard directive requiring that all United States federal government websites provide service only via HTTPS, with a deadline of end of 2016.<ref>{{Cite web|url = https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2015/m-15-13.pdf|title = Policy to Require Secure Connections across Federal Websites and Web Services|date = June 8, 2015|last = Scott|first = Tony|accessdate = November 20, 2017}}</ref><ref>{{cite web|url = https://obamawhitehouse.archives.gov/blog/2015/06/08/https-everywhere-government|title = HTTPS-Everywhere for Government|last = Scott|first = Tony|date = June 8, 2015|accessdate = November 20, 2017|publisher = Obama White House Archives}}</ref><ref>{{cite web|url = https://www.computerworld.com/article/2933172/government-it/us-to-require-https-for-all-government-websites.html|title = US to require HTTPS for all government websites. All public sites will be required to use the protocol by the end of 2016|last = Williams|first = Martyn|date = June 8, 2015|accessdate = November 20, 2017}}</ref> | ||
| Line 137: | Line 194: | ||
|- | |- | ||
| 2016 || {{dts|March 23}} || || || || Google provides a list of certificate authorities it does not trust.<ref>{{cite web|url = https://www.theregister.co.uk/2016/03/23/google_now_publishing_a_list_of_cas_it_doesnt_trust/|title = Google publishes list of Certificate Authorities it doesn't trust. Thawte experiment aims to expose issuers of dodgy creds|last = Chirgwin|first = Richard|date = March 23, 2016|accessdate = November 20, 2017|publisher = ''The Register''}}</ref> | | 2016 || {{dts|March 23}} || || || || Google provides a list of certificate authorities it does not trust.<ref>{{cite web|url = https://www.theregister.co.uk/2016/03/23/google_now_publishing_a_list_of_cas_it_doesnt_trust/|title = Google publishes list of Certificate Authorities it doesn't trust. Thawte experiment aims to expose issuers of dodgy creds|last = Chirgwin|first = Richard|date = March 23, 2016|accessdate = November 20, 2017|publisher = ''The Register''}}</ref> | ||
| + | |- | ||
| + | | 2016 || {{dts|February}} || Browser || Baidu Browser || Vulnerability exploit || The Citizen Lab publishes a report noting vulnerabilities in the Baidu Browser, a popular browser in China, some of which are related to the browser not using HTTPS fully.<ref>{{cite web|url = https://phys.org/news/2016-02-privacy-problems-popular-baidu-browser.html|title = Researchers find privacy problems in popular Baidu browser|last = Gillis|first = Alex|date = February 26, 2016|accessdate = April 13, 2019}}</ref> | ||
| + | |- | ||
| + | | 2016 || {{dts|March 28}} || Browser || QQ Browser || Vulnerability exploit || The Citizen Lab publishes a report noting vulnerabilities in the QQ Browser, a popular browser in China, some of which are related to the browser not using HTTPS fully.<ref>{{cite web|url = https://citizenlab.ca/2016/03/privacy-security-issues-qq-browser/|title = Privacy and Security Issues in QQ Browser|last = Knockel|first = Jeffrey|last2 = Senft|first2 = Adam|last3 = Deibert|first3 = Ron|date = March 28, 2016|accessdate = April 13, 2019|publisher = The Citizen Lab}}</ref> | ||
| + | |- | ||
| + | | 2016 || {{dts|April 8}} || Website || WordPress || Default HTTPS-only || Automattic, the owner of WordPress.com, announces that WordPress custom domains will be switched to default HTTPS-only. Previously, HTTPS-only was enabled only on subdomains of wordpress.com.<ref>{{cite web|url = https://en.blog.wordpress.com/2016/04/08/https-everywhere-encryption-for-all-wordpress-com-sites/|title = HTTPS Everywhere: Encryption for All WordPress.com Sites. We’re proud to support a more secure web — now for all custom domains on WordPress.com.|author = Barry|date = April 8, 2016|accessdate = December 1, 2019|publisher = The WordPress.com Blog}}</ref> | ||
| + | |- | ||
| + | | 2016 || {{dts|April 28}} (first announcement), {{dts|August 15}} (completion) || Website || WIRED || Default HTTPS-only || On April 28, ''WIRED'' announces that its website is going HTTPS-only. The article announcing the transition explains the challenges involved in making sure every digital asset loaded on every page is HTTPS.<ref>{{cite web|url = https://www.wired.com/2016/04/wired-launching-https-security-upgrade/|title = WE'RE GOING HTTPS: HERE'S HOW WIRED IS TACKLING A HUGE SECURITY UPGRADE|last = Tollman|first = Zack|date = April 28, 2016|accessdate = February 11, 2018|publisher = ''WIRED''}}</ref> The transition is announced to be complete on August 15.<ref>{{cite web|url = https://www.wired.com/2016/09/wired-completely-encrypted/|title = How WIRED Completely Encrypted Itself|last = Tollman|first = Zack|date = August 15, 2016|accessdate = December 1, 2019}}</ref> | ||
| + | |- | ||
| + | | 2016 || {{dts|June 14}} || App store service || Apple || Default HTTPS-only || At the {{w|Apple Worldwide Developers Conference}}, Apple announces that it will require all iOS apps to use HTTPS connections by the end of 2016.<ref>{{cite web|url = https://techcrunch.com/2016/06/14/apple-will-require-https-connections-for-ios-apps-by-the-end-of-2016/|title = Apple will require HTTPS connections for iOS apps by the end of 2016|last = Conger|first = Kate|date = June 14, 2016|accessdate = February 11, 2018|publisher = ''TechCrunch''}}</ref> | ||
|- | |- | ||
| 2016 || {{dts|June 15}} || Website || TechCrunch || Default HTTPS-only || Technology new website ''{{w|TechCrunch}}'' announces that it has gone HTTPS-only.<ref>{{Cite web|url = https://techcrunch.com/2016/06/15/techcrunch-has-gone-https/|title = TechCrunch has gone HTTPS|last = Wilke|first = Nicole|date = June 15, 2016|accessdate = November 19, 2017}}</ref> | | 2016 || {{dts|June 15}} || Website || TechCrunch || Default HTTPS-only || Technology new website ''{{w|TechCrunch}}'' announces that it has gone HTTPS-only.<ref>{{Cite web|url = https://techcrunch.com/2016/06/15/techcrunch-has-gone-https/|title = TechCrunch has gone HTTPS|last = Wilke|first = Nicole|date = June 15, 2016|accessdate = November 19, 2017}}</ref> | ||
| Line 145: | Line 212: | ||
|- | |- | ||
| 2016 || {{dts|August 25}} || Report/Observatory || Mozilla || State of HTTPS adoption || Mozilla, the organization that manages the {{w|Firefox}} browser, creates the Mozilla Observatory to track the web and its security. Among other things, this tracks the state of HTTPS adoption.<ref>{{cite web|url = https://pokeinthe.io/2016/08/25/observatory-by-mozilla-a-new-tool/|title = Observatory by Mozilla: Making the Web Safer|last = King|first = April|date = April 25, 2016|accessdate = November 20, 2017}}</ref><ref>{{cite web|url = http://securityaffairs.co/wordpress/50656/security/mozilla-observatory-tool.html|title = Mozilla launched the Observatory tool to test the security of websites|last = Paganini|first = Pierluigi|date = August 27, 2016|accessdate = November 20, 2017}}</ref> | | 2016 || {{dts|August 25}} || Report/Observatory || Mozilla || State of HTTPS adoption || Mozilla, the organization that manages the {{w|Firefox}} browser, creates the Mozilla Observatory to track the web and its security. Among other things, this tracks the state of HTTPS adoption.<ref>{{cite web|url = https://pokeinthe.io/2016/08/25/observatory-by-mozilla-a-new-tool/|title = Observatory by Mozilla: Making the Web Safer|last = King|first = April|date = April 25, 2016|accessdate = November 20, 2017}}</ref><ref>{{cite web|url = http://securityaffairs.co/wordpress/50656/security/mozilla-observatory-tool.html|title = Mozilla launched the Observatory tool to test the security of websites|last = Paganini|first = Pierluigi|date = August 27, 2016|accessdate = November 20, 2017}}</ref> | ||
| + | |- | ||
| + | | 2016 || {{dts|September}} (completion), November 29 (announcement) || Website || The Guardian || Default HTTPS-only || ''The Guardian'' announces that it completed its migration to HTTPS-only about two months ago. The announcement post describes the challenges of the migration, including avoiding negative audience and revenue impacts, and keeping older interactive content working. The migration approach is summarized as: migrate one small audience section to HTTPS, identify the problems and track them, and fix the problems that need to be fixed before the next section migration. Three complementary techniques used: monitoring, decoupling backend and frontend migrations (with backend migrations done first), and usage of early adopters (users could opt in to HTTPS-only before moving to default HTTPS-only). Technical details of the migration are also included in the post.<ref>{{cite web|url = https://www.theguardian.com/info/developer-blog/2016/nov/29/the-guardian-has-moved-to-https|title = The Guardian has moved to HTTPS. Discover why and how the Guardian has moved to HTTPS, the secure version of the web protocol that helps to protect user privacy|last = Chauvin|first = Mariot|last2 = Islam|first2 = Huma|date = November 29, 2016|accessdate = April 13, 2019|publisher = The Guardian}}</ref> | ||
| + | |- | ||
| + | | 2016 || {{dts|October 23}} || Website || || || <code>neverssl.com</code> is registered.<ref>{{cite web |title=neverssl.com |url=https://who.is/whois/neverssl.com |website=who.is |accessdate=24 February 2020}}</ref> Motivated by the existence of broken "{{w|Wifi}} capture" networks that don't work well with HTTPS, the site is created "to make logging on a little bit easier".<ref>{{cite web |title=NeverSSL |url=http://neverssl.com/changes |website=neverssl.com/ |accessdate=24 February 2020}}</ref> | ||
|- | |- | ||
| 2017 || {{dts|January 10}} || Website || New York Times || Default HTTPS-only || The ''New York Times'' announces that it has made a number of its articles default to HTTPS, including the home page, section and topic pages, and all articles published 2014 or later, and that it plans to make the rest of its site HTTPS as well.<ref>{{cite web|url = https://open.blogs.nytimes.com/2017/01/10/https-on-nytimes-com/|title = HTTPS on NYTimes.com|last = Konigsburg|first = Eitan|last2 = Wan|first2 = Vinessa|publisher = ''New York Times'' Open blog|date = January 1, 2010|accessdate = November 19, 2017}}</ref> | | 2017 || {{dts|January 10}} || Website || New York Times || Default HTTPS-only || The ''New York Times'' announces that it has made a number of its articles default to HTTPS, including the home page, section and topic pages, and all articles published 2014 or later, and that it plans to make the rest of its site HTTPS as well.<ref>{{cite web|url = https://open.blogs.nytimes.com/2017/01/10/https-on-nytimes-com/|title = HTTPS on NYTimes.com|last = Konigsburg|first = Eitan|last2 = Wan|first2 = Vinessa|publisher = ''New York Times'' Open blog|date = January 1, 2010|accessdate = November 19, 2017}}</ref> | ||
| + | |- | ||
| + | | 2017 || {{dts|January 21}} || Guideline || American Library Association || HTTPS use guideline || The American Library Association publishes a library privacy checklist approved by its intellectual freedom committee. The checklist mentions HTTPS twice. In priority 1 actions, it includes an action "Ensure all existing security certificates for HTTPS/SSL are valid and create a procedure for revalidating them annually." In priority 2 actions, it includes an action "Utilize HTTPS wherever possible." (Ironically, even as of April 2019, the American Library Association website does not properly support HTTPS, with the HTTPS site redirecting to the HTTP site).<ref>{{cite web|url = http://www.ala.org/advocacy/privacy/checklists/overview|title = Library Privacy Checklist - Overview|date = January 21, 2017|accessdate = April 13, 2019|publisher = American Library Association}}</ref> | ||
| + | |- | ||
| + | | 2017 || {{dts|January 25}} || Website || Ars Technica || Default HTTPS-only || ''{{w|Ars Technica}}'' announces that it has switched to default HTTPS-only, and explains details of the move.<ref>{{cite web|url = https://arstechnica.com/information-technology/2017/01/ars-announces-https-by-default-finally/|title = Ars announces HTTPS by default (finally). Doing our part to push the encrypted-by-default vision of the Web.|last = Hutchinson|first = Lee|date = January 25, 2017|accessdate = December 1, 2019|publisher = Ars Technica}}</ref> | ||
|- | |- | ||
| 2017 || {{dts|January}} || Browser || Chrome || Security warning || With version 56, {{w|Google Chrome}} begins marking as "Not Secure" (in the address bar) any webpages collecting sensitive data such as passwords or credit-card information without using HTTPS.<ref name=not-secure-october-plans>{{cite web|url = https://www.searchenginejournal.com/google-is-requiring-https-for-secure-data-in-chrome/183756/|title = Google Is Requiring HTTPS for Secure Data in Chrome|last = Murray|first = Brock|date = January 21, 2017|accessdate = November 19, 2017}}</ref><ref name=zdnet-noose>{{cite web|url = http://www.zdnet.com/article/google-tightens-noose-on-http-chrome-to-stick-not-secure-on-pages-with-search-fields/|title = Google tightens noose on HTTP: Chrome to stick 'Not secure' on pages with search fields. In October, Google will begin phase two of its plan to label all HTTP pages as non-secure.|last = Tung|first = Liam|date = April 28, 2017|accessdate = November 15, 2017|publisher = ZDNet}}</ref> | | 2017 || {{dts|January}} || Browser || Chrome || Security warning || With version 56, {{w|Google Chrome}} begins marking as "Not Secure" (in the address bar) any webpages collecting sensitive data such as passwords or credit-card information without using HTTPS.<ref name=not-secure-october-plans>{{cite web|url = https://www.searchenginejournal.com/google-is-requiring-https-for-secure-data-in-chrome/183756/|title = Google Is Requiring HTTPS for Secure Data in Chrome|last = Murray|first = Brock|date = January 21, 2017|accessdate = November 19, 2017}}</ref><ref name=zdnet-noose>{{cite web|url = http://www.zdnet.com/article/google-tightens-noose-on-http-chrome-to-stick-not-secure-on-pages-with-search-fields/|title = Google tightens noose on HTTP: Chrome to stick 'Not secure' on pages with search fields. In October, Google will begin phase two of its plan to label all HTTP pages as non-secure.|last = Tung|first = Liam|date = April 28, 2017|accessdate = November 15, 2017|publisher = ZDNet}}</ref> | ||
| + | |- | ||
| + | | 2017 || {{dts|January 4}} || Website || National Public Radio || Default HTTPS-only || {{w|National Public Radio}} announces that it has transitioned most of its webpages and streaming content to HTTPS, and is making sure that any new content is served through HTTPS.<ref>{{cite web|url = http://digitalservices.npr.org/post/update-https-transition-streams-and-podcasts|title = Update to the HTTPS Transition for Streams and Podcasts|last = Faughan|first = Kate|date = January 4, 2017|accessdate = February 11, 2018|publisher = National Public Radio}}</ref> | ||
| + | |- | ||
| + | | 2017 || {{dts|January 10}} || Website || W Magazine || Default HTTPS-only || A post on the ''Condé Nast'' technology blog, describes the transition of [[w:W (magazine)|W Magazine]], a Conde Nast property, to HTTPS.<ref>{{cite web|url = https://technology.condenast.com/story/securing-w-magazine-our-migration-to-https|title = Securing W Magazine: Our Migration to HTTPS|date = July 10, 2017|accessdate = December 1, 2019|last = Colucci|first = David}}</ref> | ||
|- | |- | ||
| 2017 || {{dts|March 30}} || Website || Pornhub || Default HTTPS-only || {{w|Pornhub}}, the world's largest pornographic video site, switches to HTTPS-only. Sister service YouPorn is scheduled to go HTTPS-only on April 4.<ref>{{cite web|url = https://www.wired.com/2017/03/pornhub-https-encryption/|title = THE WORLD'S BIGGEST PORN SITE GOES ALL-IN ON ENCRYPTION|last = Barrett|first = Brian|date = March 30, 2017|accessdate = November 9, 2017|publisher = ''Wired''}}</ref><ref>{{cite web|url = https://www.theverge.com/2017/3/30/15125048/pornhub-youporn-https-encryption-privacy|title = Pornhub now turns on encryption by default|last = Garun|first = Natt|date = March 30, 2017|accessdate = November 19, 2017|publisher = ''The Verge''}}</ref> | | 2017 || {{dts|March 30}} || Website || Pornhub || Default HTTPS-only || {{w|Pornhub}}, the world's largest pornographic video site, switches to HTTPS-only. Sister service YouPorn is scheduled to go HTTPS-only on April 4.<ref>{{cite web|url = https://www.wired.com/2017/03/pornhub-https-encryption/|title = THE WORLD'S BIGGEST PORN SITE GOES ALL-IN ON ENCRYPTION|last = Barrett|first = Brian|date = March 30, 2017|accessdate = November 9, 2017|publisher = ''Wired''}}</ref><ref>{{cite web|url = https://www.theverge.com/2017/3/30/15125048/pornhub-youporn-https-encryption-privacy|title = Pornhub now turns on encryption by default|last = Garun|first = Natt|date = March 30, 2017|accessdate = November 19, 2017|publisher = ''The Verge''}}</ref> | ||
|- | |- | ||
| 2017 || {{dts|May 22}} || Website || Stack Overflow || Default HTTPS-only || {{w|Stack Overflow}} announces that it has migrated to HTTPS, after four years of work on the migration. All other Stack Exchange websites are also moved over to HTTPS.<ref>{{cite web|url = https://nickcraver.com/blog/2017/05/22/https-on-stack-overflow/|title = HTTPS on Stack Overflow: The End of a Long Road|date = May 22, 2017|accessdate = November 19, 2017|last = Craver|first = Nick}}</ref><ref>{{cite web|url = https://stackoverflow.blog/2017/05/22/stack-overflow-flipped-switch-https/|title = How Stack Overflow Flipped the Switch on HTTPS|last = Taylor|first = Anita|date = May 22, 2017|accessdate = November 19, 2017|publisher = Stack Overflow}}</ref> | | 2017 || {{dts|May 22}} || Website || Stack Overflow || Default HTTPS-only || {{w|Stack Overflow}} announces that it has migrated to HTTPS, after four years of work on the migration. All other Stack Exchange websites are also moved over to HTTPS.<ref>{{cite web|url = https://nickcraver.com/blog/2017/05/22/https-on-stack-overflow/|title = HTTPS on Stack Overflow: The End of a Long Road|date = May 22, 2017|accessdate = November 19, 2017|last = Craver|first = Nick}}</ref><ref>{{cite web|url = https://stackoverflow.blog/2017/05/22/stack-overflow-flipped-switch-https/|title = How Stack Overflow Flipped the Switch on HTTPS|last = Taylor|first = Anita|date = May 22, 2017|accessdate = November 19, 2017|publisher = Stack Overflow}}</ref> | ||
| + | |- | ||
| + | | 2017 || May through {{dts|August 16}} || Website || Springer-Verlag || Default HTTPS-only || Publisher Springer transitions its websites to HTTPS, with HTTP redirecting to HTTPS.<ref>{{cite web|url = https://knowledge.exlibrisgroup.com/360_Services/360_Link/Knowledge_Articles/360_Link%3A_Springer_Transition_to_https_--_effective_August_16%2C_2017|title = 360 Link: Springer Transition to https -- effective August 16, 2017|date = August 7, 2017|accessdate = February 11, 2017|publisher = ExLibris Knowledge Center}}</ref><ref>{{cite web|url = https://springeronlineservice.freshdesk.com/support/solutions/articles/6000165911-switching-to-https|title = Switching to HTTPS|publisher = Springer Online Service on Freshdesk|date = September 6, 2017|accessdate = February 11, 2018}}</ref> | ||
| + | |- | ||
| + | | 2017 || {{dts|September 11}} || || || || The Google Security Blog announces Google Chrome's finalized plans to distrust certificates issued by Symantec.<ref>{{cite web|url = https://security.googleblog.com/2017/09/chromes-plan-to-distrust-symantec.html|title = Chrome’s Plan to Distrust Symantec Certificates|date = September 11, 2017|accessdate = April 13, 2019|publisher = Google Security Blog|last = O'Brien|first = Devon|last2 = Sleevi|first2 = Ryan|last3 = Whalley|first3 = Andrew}}</ref> The SSL Store blogs about it with some commentary explaining the controversy.<ref>{{cite web|url = https://www.thesslstore.com/blog/google-chrome-distrust-symantec-ssl-certificates/|title = Official: Google Chrome’s Plan to Distrust Symantec SSL Certificates The announcement being circulated simply finalizes an agreement from July|publisher = The SSL Store|date = September 13, 2017|accessdate = April 13, 2019}}</ref> | ||
|- | |- | ||
| 2017 || {{dts|September 13}} || Website || Imgur || Default HTTPS-only || Image-hosting service {{w|Imgur}} defaults to HTTPS-only for all users (both logged-in and others).<ref>{{cite web|url = https://community.imgur.com/t/defaulting-to-https-01-xx-2015-request-fulfilled-as-of-09-13-2017/5146/59|title = Defaulting to https (01-XX-2015) - Request fulfilled as of 09-13-2017!|date = January 29, 2015|accessdate = November 20, 2017}}</ref> | | 2017 || {{dts|September 13}} || Website || Imgur || Default HTTPS-only || Image-hosting service {{w|Imgur}} defaults to HTTPS-only for all users (both logged-in and others).<ref>{{cite web|url = https://community.imgur.com/t/defaulting-to-https-01-xx-2015-request-fulfilled-as-of-09-13-2017/5146/59|title = Defaulting to https (01-XX-2015) - Request fulfilled as of 09-13-2017!|date = January 29, 2015|accessdate = November 20, 2017}}</ref> | ||
| Line 159: | Line 242: | ||
|- | |- | ||
| 2017 || || Report || Research at Google || State of HTTPS adoption || Research at Google publishes a paper titled ''Measuring HTTPS adoption on the web''.<ref>{{cite web|url = https://research.google.com/pubs/pub46197.html|title = Measuring HTTPS adoption on the web|accessdate = November 20, 2017|last = Feit|first = Adrienne Porter|last2 = Barnes|first2 = Richard|last3 = King|first3 = April|last4 = Palmer|first4 = Chris|last5 = Bentzel|first5 = Chris|last6 = Tabriz|first6 = Parisa}}</ref><ref>{{cite web|url = https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/46197.pdf|title = Measuring HTTPS adoption on the web|accessdate = November 20, 2017|last = Feit|first = Adrienne Porter|last2 = Barnes|first2 = Richard|last3 = King|first3 = April|last4 = Palmer|first4 = Chris|last5 = Bentzel|first5 = Chris|last6 = Tabriz|first6 = Parisa}}</ref> | | 2017 || || Report || Research at Google || State of HTTPS adoption || Research at Google publishes a paper titled ''Measuring HTTPS adoption on the web''.<ref>{{cite web|url = https://research.google.com/pubs/pub46197.html|title = Measuring HTTPS adoption on the web|accessdate = November 20, 2017|last = Feit|first = Adrienne Porter|last2 = Barnes|first2 = Richard|last3 = King|first3 = April|last4 = Palmer|first4 = Chris|last5 = Bentzel|first5 = Chris|last6 = Tabriz|first6 = Parisa}}</ref><ref>{{cite web|url = https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/46197.pdf|title = Measuring HTTPS adoption on the web|accessdate = November 20, 2017|last = Feit|first = Adrienne Porter|last2 = Barnes|first2 = Richard|last3 = King|first3 = April|last4 = Palmer|first4 = Chris|last5 = Bentzel|first5 = Chris|last6 = Tabriz|first6 = Parisa}}</ref> | ||
| + | |- | ||
| + | | 2017 || || Standard || TLS 1.3 || Protocol || The standard for TLS 1.3 is under discussion, but not finalized. Browsers support it for a while as the default but then stop due to issues. See [[w:Transport Layer Security#TLS_1.3_.28draft.29]] for more. As of the end of 2017, TLS 1.3 is still not ready.<ref>{{cite web|url = https://blog.cloudflare.com/why-tls-1-3-isnt-in-browsers-yet/|title = Why TLS 1.3 isn't in browsers yet|last = Sullivan|first = Nick|date = December 26, 2017|accessdate = January 28, 2018|publisher = Cloudflare}}</ref> | ||
| + | |- | ||
| + | | 2017 || {{dts|December 30}} || || || || <code>nonhttps.com<code/> is registered.<ref>{{cite web |title=nonhttps.com |url=https://who.is/whois/nonhttps.com |website=who.is |accessdate=24 February 2020}}</ref> Similar to <code>neverssl.com</code>, the site is created to for websites to "guarantee that they will always remain accessible by HTTP".<ref>{{cite web |title=HTTPS |url=https://wikivisually.com/wiki/HTTPS |website=wikivisually.com |accessdate=24 February 2020}}</ref> | ||
| + | |- | ||
| + | | 2018 || {{dts|February 27}} || Certificate authority || Let's Encrypt || Wildcard support || Let's Encrypt plans to make wildcard support fully available on this date, after launching a public test API endpoint for the ACME v2 protocol and wildcard support on January 4, 2018.<ref>{{cite web|url = https://letsencrypt.org/2017/07/06/wildcard-certificates-coming-jan-2018.html|title = Wildcard Certificates Coming January 2018|last = Aas|first = Josh|date = July 6, 2017|accessdate = January 28, 2018|publisher = Let's Encrypt}}</ref> | ||
| + | |- | ||
| + | | 2018 || {{dts|April 1}} || CDN || Cloudflare || Secure DNS resolver || Cloudflare launches 1.1.1.1, a secure DNS resolver that uses both DNS-over-TLS and DNS-over-HTTPS.<ref>{{cite web|url = https://blog.cloudflare.com/announcing-1111/|title = Announcing 1.1.1.1: the fastest, privacy-first consumer DNS service|last = Prince|first = Matthew|date = April 1, 2018|accessdate = December 1, 2019|publisher = Cloudflare}}</ref> | ||
| + | |- | ||
| + | | 2018 || {{dts|April 14}} || Website || IMDb || Default HTTPS-only || Judging from homepage captures on the Internet Archive's Wayback Machine, this is the date that the IMDb transitions from HTTP to default HTTPS-only. See captures for April 13<ref>{{cite web|url = http://web.archive.org/web/20180413090715/http://www.imdb.com/|title = IMDb, as captured on April 13, 2018|date = April 13, 2018|accessdate = April 13, 2019}}</ref> and April 14.<ref>{{cite web|url = http://web.archive.org/web/20180414091804/https://www.imdb.com/|title = IMDb, as captured on April 14, 2018|date = April 14, 2018|accessdate = April 13, 2019}}</ref> There does not appear to be any official announcement of the transition, but a Quora question with answers as late as February 2018 confirms that people noticed that the site was still using plain HTTP till February 2018.<ref>{{cite web|url = https://www.quora.com/Why-does-IMDB-use-http-and-not-HTTPS|title = Why does IMDB use http and not HTTPS?|accessdate = April 13, 2019|publisher = Quora}}</ref> | ||
| + | |- | ||
| + | | 2018 || {{dts|June}} (completion), July 9 (announcement) || Website || BBC || Default HTTPS-only || In a blog post on July 9, 2018, software engineer James Donohue announces that the BBC has completed transitioning its website to HTTPS-only a few weeks ago. The blog post explains some of the technical challenges of migrating the site (which has news content from as far back as 1997, when the site first went online), and the steps involved in completing the migration.<ref>{{cite web|url = https://www.bbc.co.uk/blogs/internet/entries/b0807897-7c07-44eb-8d5f-3b2d081a3951|title = BBC News on HTTPS|date = July 9, 2018|accessdate = April 13, 2019|publisher = BBC|last = Donohue|first = James}}</ref> | ||
| + | |- | ||
| + | | 2018 || {{dts|July 24}} || Website || Whynohttps || Security warning || <code>whynohttps.com</code> launches as a project that tracks the world's largest websites not implementing HTTPS by default.<ref>{{cite web |title=Why No HTTPS? Here's the World's Largest Websites Not Redirecting Insecure Requests to HTTPS |url=https://www.troyhunt.com/why-no-https-heres-the-worlds-largest-websites-not-redirecting-insecure-requests/ |website=troyhunt.com |accessdate=24 February 2020}}</ref><ref>{{cite web |title=Still Why No HTTPS? |url=https://www.troyhunt.com/still-why-no-https/ |website=troyhunt.com |accessdate=24 February 2020}}</ref> | ||
| + | |- | ||
| + | | 2018 || {{dts|July}} (planned date), February 8 (announcement) || Browser || Chrome || Security warning || On February 8, Google Chrome announces that starting with Chrome 68, which will be released in July, all plain HTTP sites will be marked as not secure.<ref>{{cite web|url = https://security.googleblog.com/2018/02/a-secure-web-is-here-to-stay.html|title = A secure web is here to stay|date = February 8, 2018|accessdate = February 11, 2018|publisher = Google Security Blog|last = Schechter|first = Emily}}</ref><ref>{{cite web|url = https://techcrunch.com/2018/02/08/chrome-will-soon-mark-all-unencrypted-pages-as-not-secure/|title = Chrome will soon mark all unencrypted pages as ‘not secure’|last = Lardinois|first = Frederic|date = February 8, 2018|accessdate = February 11, 2018|publisher = ''TechCrunch''}}</ref><ref>{{cite web|url = https://arstechnica.com/gadgets/2018/02/from-july-on-chrome-will-brand-plain-old-http-as-not-secure/|title = From July on, Chrome will brand plain old HTTP as “Not secure”. The "Not secure" label will go where the padlock would go for an encrypted connection.|last = Bright|first = Peter|date = February 9, 2018|accessdate = February 11, 2018|publisher = ''ArsTechnica''}}</ref> The release happens as scheduled. ''Forbes'' publishes an article naming a few sites that still do not default to HTTPS as of the time of this change to Chrome. The sites include Fox News, the Los Angeles Times, Chicago Tribune, Time, ESPN, NFL Network, NBA, and more. Some of these sites, such as Time and ESPN, still do not default to HTTPS as of April 2019.<ref>{{cite web|url = https://www.forbes.com/sites/kevinmurnane/2018/07/25/here-are-12-well-known-websites-that-chrome-68-labels-not-secure/|title = Fox News, ESPN And 9 Other Well-Known Websites That Chrome 68 Labels 'Not Secure'|last = Murnane|first = Kevin|date = July 25, 2018|accessdate = April 13, 2019|publisher = Forbes}}</ref> | ||
| + | |- | ||
| + | | 2018 || {{dts|August 7}} || Website || BBC || Site-wide censorship due to HTTPS adoption || The BBC website is blocked in China shortly after it migrated to HTTPS-only. For HTTPS websites, it is not possible for intermediaries in the network to identify individual pages being browsed, so the Chinese government needs to block the whole site in order to block access to politically sensitive content.<ref>{{cite web|url = https://www.bbc.com/news/technology-45098190|title = BBC websites blocked in China after security change|date = August 7, 2018|accessdate = April 13, 2019}}</ref> | ||
| + | |- | ||
| + | | 2018 || {{dts|September 24}} || CDN || Cloudflare || Support for encrypted SNI || {{w|Cloudflare}} announces that it is beginning support of encrypted SNI.<ref>{{cite web|url = https://blog.cloudflare.com/esni/|title = Encrypting SNI: Fixing One of the Core Internet Bugs|last = Prince|first = Matthew|date = September 24, 2018|accessdate = December 1, 2019|publisher = Cloudflare}}</ref><ref>{{cite web|url = https://blog.cloudflare.com/encrypted-sni/|title = Encrypt it or lose it: how encrypted SNI works|last = Ghedini|first = Alessandro|date = September 24, 2018|accessdate = December 1, 2019|publisher = Cloudflare}}</ref> | ||
| + | |- | ||
| + | | 2018 || {{dts|October 18}} || Browser || Firefox || Support for encrypted SNI || {{w|Firefox}} announces support for encrypted SNI in the Firefox Nightly build.<ref>{{cite web|url = https://blog.mozilla.org/security/2018/10/18/encrypted-sni-comes-to-firefox-nightly/|title = Encrypted SNI Comes to Firefox Nightly|last = Rescorla|first = Eric|date = October 18, 2018|accessdate = December 1, 2019|publisher = Mozilla}}</ref><ref>{{cite web|url = https://blog.cloudflare.com/encrypt-that-sni-firefox-edition/|title = Encrypt that SNI: Firefox edition|date = October 18, 2018|accessdate = December 1, 2019|publisher = Cloudflare}}</ref> | ||
| + | |- | ||
| + | | 2018 || c.{{dts|November 17}} || Calendar service || {{w|Google Calendar}} || HTTPS adoption || {{w|Google Calendar}} goes 100% HTTPS.<ref name="ss"/> | ||
| + | |- | ||
| + | | 2019 || {{dts|January}} to February; with some early test efforts in October 2018, and some wrap-up work as late as April 11 || Website || Wikia / Fandom || Default HTTPS-only || Fandom Inc., the company previously known as Wikia, moves the bulk of their community wikis from HTTP to HTTPS, while also changing the domain from wikia.com to fandom.com (to be more consistent with the company's new name and branding). Some domains that do not fit with the Fandom brand are moved to wikia.org instead; these are also migrated to HTTPS.<ref>{{cite web|url = https://community.fandom.com/wiki/Help:Fandom_domain_migration|title = Help:Fandom domain migration|accessdate = April 13, 2019|publisher = Fandom Community Central}}</ref> | ||
| + | |- | ||
| + | | 2019 || {{dts|August}} || Browser || Chrome || Interface simplification || With Chrome 76, Google stops showing the leading https and www on urls in the address bar; however, these are shown if you click into the address bar twice. The Chrome team says that this simplifies the experience for most users by removing information that's not relevant to them, but there is some pushback to these claims from people who believe the information is important and should be readily visible.<ref>{{cite web|url = https://www.ghacks.net/2019/08/01/chrome-76-no-more-https-or-www-in-address-bar/|title = Chrome 76: no more https or www in address bar|last = Brinkmann|first = Martin|date = August 16, 2019|accessdate = December 1, 2019}}</ref> Users can still determine if a site is secure by looking for the lock icon; insecure sites will be marked "Not Secure". | ||
| + | |- | ||
| + | | 2019 || c.{{dts|September 28}} || Online advertising platform || Google Ads || HTTPS adoption || Google Ads goes 100% HTTPS.<ref name="ss">{{cite web |title=HTTPS encryption on the web |url=https://transparencyreport.google.com/https/overview |website=transparencyreport.google.com |accessdate=1 March 2020}}</ref> | ||
| + | |- | ||
| + | | 2019 || c.{{dts|September}} || Online video platform || Youtube || HTTPS adoption || {{w|Youtube}} goes 100% HTTPS.<ref name="ss"/> | ||
| + | |- | ||
|} | |} | ||
| + | |||
| + | == Numerical and visual data == | ||
| + | |||
| + | === Google Scholar === | ||
| + | |||
| + | The following table summarizes per-year mentions on Google Scholar as of June 10, 2021. | ||
| + | |||
| + | {| class="sortable wikitable" | ||
| + | ! Year | ||
| + | ! http | ||
| + | ! https | ||
| + | ! https security | ||
| + | ! https adoption | ||
| + | |- | ||
| + | | 1980 || 145,000 || 196,000 || 33,400 || 4,120 | ||
| + | |- | ||
| + | | 1985 || 153,000 || 219,000 || 13,800 || 4,460 | ||
| + | |- | ||
| + | | 1990 || 183,000 || 309,000 || 54,200 || 5,880 | ||
| + | |- | ||
| + | | 1995 || 341,000 || 436,000 || 19,600 || 7.320 | ||
| + | |- | ||
| + | | 2000 || 1,520,000 || 1,300,000 || 68,600 || 14,400 | ||
| + | |- | ||
| + | | 2002 || 1,430,000 || 1,360,000 || 41,000 || 19,500 | ||
| + | |- | ||
| + | | 2004 || 2,360,000 || 1,650,000 || 82,300 || 37,600 | ||
| + | |- | ||
| + | | 2006 || 2,530,000 || 1,730,000 || 132,000 || 70,700 | ||
| + | |- | ||
| + | | 2008 || 2,620,000 || 1,800,000 || 172,000 || 102,000 | ||
| + | |- | ||
| + | | 2010 || 2,610,000 || 2,020,000 || 271,000 || 130,000 | ||
| + | |- | ||
| + | | 2012 || 2,650,000 || 2,240,000 || 365,000 || 166,000 | ||
| + | |- | ||
| + | | 2014 || 2,310,000 || 2,230,000 || 481,000 || 187,000 | ||
| + | |- | ||
| + | | 2016 || 1,950,000 || 1,870,000 || 606,000 || 179,000 | ||
| + | |- | ||
| + | | 2017 || 1,760,000 || 1,690,000 || 602,000 || 190,000 | ||
| + | |- | ||
| + | | 2018 || 1,590,000 || 1,570,000 || 480,000 || 172,000 | ||
| + | |- | ||
| + | | 2019 || 901,000 || 1,200,000 || 319,000 || 140,000 | ||
| + | |- | ||
| + | | 2020 || 444,000 || 635,000 || 198,000 || 87,600 | ||
| + | |- | ||
| + | |} | ||
| + | |||
| + | [[File:Http tb.png|thumb|center|700px]] | ||
| + | |||
| + | === Google Trends === | ||
| + | |||
| + | The comparative chart below shows {{w|Google Trends}} data HTTPS (Search term) and HTTP (Search term), from March 2004 to March 2021, when the screenshot was taken. Interest is also ranked by country and displayed on world map.<ref>{{cite web |title=HTTPS and HTTP |url=https://trends.google.com/trends/explore?date=all&q=HTTPS,HTTP |website=Google Trends |access-date=14 March 2021}}</ref> | ||
| + | |||
| + | [[File:HTTP and HTTPS gt.png|thumb|center|600px]] | ||
| + | |||
| + | === Google Ngram Viewer === | ||
| + | The chart below shows {{w|Google Ngram Viewer}} data for HTTPS and HTTP, from 1989 to 2019.<ref>{{cite web |title=HTTPS and HTTP |url=https://books.google.com/ngrams/graph?content=HTTPS%2CHTTP&year_start=1989&year_end=2019&corpus=26&smoothing=3 |website=books.google.com |access-date=14 March 2021 |language=en}}</ref> | ||
| + | |||
| + | [[File:HTTP and HTTPS ngram.png|thumb|center|700px]] | ||
| + | |||
| + | === Wikipedia Views === | ||
| + | The chart below shows pageviews of the English Wikipedia article {{w|HTTPS}} on desktop from December 2007, and on mobile-web, desktop-spider,mobile-web-spider and mobile app, from July 2015; to January 2021.<ref>{{cite web |title=HTTPS |url=https://wikipediaviews.org/displayviewsformultiplemonths.php?page=HTTPS&allmonths=allmonths&language=en&drilldown=all |website=wikipediaviews.org |access-date=24 February 2021}}</ref> | ||
| + | |||
| + | [[File:HTTPS wv.png|thumb|center|400px]] | ||
| + | |||
| + | ==Meta information on the timeline== | ||
| + | |||
| + | ===How the timeline was built=== | ||
| + | |||
| + | The initial version of the timeline was written by [[User:Vipul]]. | ||
| + | |||
| + | ===What the timeline is still missing=== | ||
| + | |||
| + | * {{w|DNS over HTTPS}}: [https://tools.ietf.org/html/rfc8484 RFC] | ||
| + | * {{w|DNS over TLS}} | ||
| + | * Encrypted SNI: [https://datatracker.ietf.org/doc/draft-ietf-tls-esni/ Draft standard] | ||
| + | |||
| + | ===Timeline update strategy=== | ||
| + | |||
| + | * Keep pace with the latest developments in HTTPS | ||
| + | * Look for articles about websites and services transitioning to HTTPS | ||
| + | * Use the Wayback Machine to identify dates of transition to HTTPS | ||
| + | |||
| + | == See also == | ||
| + | |||
| + | * [https://www.jefftk.com/p/history-of-https-usage History of HTTPS Usage] by Jeff Kaufman | ||
== References == | == References == | ||
{{reflist|30em}} | {{reflist|30em}} | ||
Latest revision as of 12:23, 1 December 2024
This timeline gives a history of HTTPS usage and adoption, describing the gradual increase in websites and clients using HTTPS. HTTPS is a secure, encrypted version of HTTP and has been implemented using Sockets Layer (SSL) and Transport Layer Security (TLS). The timeline spans the period from 1994, when HTTPS and SSL were first introduced on Netscape Navigator, to 2019, by which time, thanks to the efforts of Google, Mozilla, and many privacy-focused organizations, HTTPS is ubiquitous and accounts for more traffic than plain, unencrypted HTTP.
Contents
Sample questions
- What were the major Internet standards related to HTTPS and when were they defined? (Sort the Full timeline by "Entity type" and look for the group of rows for which this says "Standard")
- When did various leading news sites migrate to HTTPS, and what challenges did they face while migrating? (Sort the Full timeline by "Entity type" and look for the group of rows for which this says" Website"; scan the "Entity name" column to find the news websites or other sites of interest to you; then read the "Details" column and look at the cited reference)
- How can we get quantitative data on how many sites and how much traffic uses HTTPS? (Sort the Full timeline by "Entity type" and look for the rows for which this says "Report" or "Report/Observatory")
Big picture
Entity types and qualitative details
HTTPS is an end-to-end protocol. Therefore, it need only be supported by the browser (on the client side) and the server (it could be terminated at the load balancer or proxy or dealt with directly by the process serving the content).
Other intermediaries, like Internet Service Providers (ISPs), routers, networking services, etc. do not need to be upgraded to support HTTPS. The main effects on them from the transition to HTTPS are: (a) the ability of their packet analyzers to sniff traffic reduces, and (b) the volume of traffic they deal with goes up a little bit.
| Entity type | Broad classification | Top entity names | Typical stages | Details |
|---|---|---|---|---|
| Standard | -- | This includes standards around client-server communication for HTTPS. Most of these are published by the Internet Engineering Task Force (IETF). | ||
| Browser | Client-side | Chrome, Firefox, Netscape Navigator | Security warning | Beyond initial HTTPS support (which was present in most browsers from the get-go), the main browser evolution has centered around the way security warnings are presented around HTTP versus HTTPS, mixed content, and problems with HTTPS certificates. |
| Browser extension | Client-side | Firesheep, HTTPS Everywhere | Vulnerability exploit, security improvement | Browser extensions have played some role in identifying and protecting against vulnerabilities of unencrypted (plain HTTP) connections. |
| Website | Server-side | Lots of websites | HTTPS available, opt-in HTTPS-only, default HTTPS-only, HTTPS-only | Websites may start by making HTTPS available, so that people who type https:// in the browser will get the HTTPS website. They may then transition to allowing logged-in users to opt-in to HTTPS-only, so that they will see internal links in HTTPS only and will automatically be redirected from HTTP to HTTPS. The next step is default HTTPS-only, which means that except for users who explicitly opt out, everybody is redirected to HTTPS (this could come in two stages: first rolled out to logged-in users only, then to all). Finally, the HTTPS-only stage is when access over plain HTTP is no longer supported. |
| Webmail | Server-side | Gmail, Hotmail, Yahoo! Mail | HTTPS available, opt-in HTTPS-only, default HTTPS-only, HTTPS-only | Similar to the stages for website. However, webmail is generally more sensitive, so the importance of switching to HTTPS is higher, and webmail services switched to HTTPS before websites. |
| Search engine | Server-side | Google Search, Bing, Yahoo! Search | HTTPS available, opt-in HTTPS-only, default HTTPS-only, HTTPS-only | Similar to the stages for website. Search engine data is intermediate in sensitivity between websites and webmail, and in terms of the chronological evolution also moved to HTTPS somewhere in between. |
| Proxy/load balancer | Server-side | Amazon Web Services | Early SSL termination | Load balancers can manage the SSL/TLS certificates and forward only plain HTTP requests to the servers that have to actually respond to the request. |
| CDN | Server-side | Cloudflare, Amazon CloudFront | Custom SSL | Content delivery networks are used to serve static content at low latency and low cost around the world. CDNs have evolved to allow customers to upload their own SSL certificates for content. |
| Ecosystem | Server-side | Advertising | Various backend ecosystems that power the technology and monetization of the web, such as advertising, need to support HTTPS in order to complete the transition to HTTPS. |
Time period grouping
| Time period | Qualitative summary of developments |
|---|---|
| 1994–2007 | During this period, many of the standards related to HTTPS (HTTP over SSL, HTTP over TLS, SNI) are published as RFCs by the Internet Engineering Task Force. Certificate authorities (CAs) come into being and the CA/Browser Forum is created. A few sites, generally those related to e-commerce, start using HTTPS. |
| 2008–2012 | The move to HTTPS begins, with Google taking the lead, and Twitter and Facebook following. Webmail moves first, then search for logged-in users. The general playbook is: HTTPS available, opt-in HTTPS-only, then default HTTPS-only. |
| 2013–2014 | The move to HTTPS continues, with laggers in webmail and search catching up on encryption, and Google beginning encryption even for non-logged-in users. Toward the end of this period, Google begins aggressively pushing for the whole web to go HTTPS, first by stating that HTTPS will be a search ranking signal, then by declaring that Chrome eventually intends to mark all plain HTTP sites as not secure. |
| 2015–2017 | This is the period when the move to HTTPS intensifies among a number of ordinary websites. Wikipedia, Reddit, Imgur, and some major newspapers and magazines like the New York Times, The Guardian, TechCrunch, and Wired go HTTPS. Chrome begins the process of marking plain HTTP sites as Not Secure. Let's Encrypt makes it easy and free for people to move to HTTPS. Google and others set up systematic tracking of the proportion of HTTPS usage, and the period ends with a significant increase in HTTPS use. This period also begins a trend of the Chinese government censoring entire websites after they transition to HTTPS, because it can no longer identify and block individual webpages due to encryption. |
| 2018–2019 | With Chrome now marking all plain HTTP sites as not secure, most high-traffic sites that had not yet migrated to HTTPS complete their migration. This includes sites like IMDb, BBC, Wikia/Fandom, Fox News, and many others. |
Full timeline
| Year | Month and date (if available) | Entity type | Entity name | Stage | Details |
|---|---|---|---|---|---|
| 1994 | Standard | SSL v1.0 | Protocol | Netscape Communications creates HTTPS for its Netscape Navigator web browser, originally for use with the Secure Sockets Layer (SSL) protocol (SSL version 1.0). Due to security issues, this is never officially published. See Transport Layer Security#SSL_1.0.2C_2.0_and_3.0. | |
| 1995 | February | Standard | SSL v2.0 | Protocol | SSL v2.0 is released. It has a number of security flaws. See w:Transport Layer Security#SSL_1.0.2C_2.0_and_3.0. |
| 1995 | July | Server hosting | Netscape | Commercial offering | Fortune reports that Netscape charges $1,495 for a server and $5,000 for a server with secure communication (i.e., serving traffic over HTTPS).[1][2] |
| 1995 | September 19 | Bugfix | Vulnerability exploit | Two graduate students at the University of California, Berkeley discover a security vulnerability with Netscape Navigator, that also affects HTTPS sites and risks credit card transactions being eavesdropped on.[3][4][2] | |
| 1996 | Standard | SSL v3.0 | Protocol | SSL v3.0 is released and its specification is drafted. IETF would publish this draft as a historical document in 2011.[5] | |
| 1999 | January | Standard | TLS 1.0 | Protocol | Version 1.0 of the Transport Layer Security (TLS) protocol is published as RFC 2246. TLS would replace SSL as the protocol used for HTTPS.[6] |
| 2000 | May | Standard | HTTP over TLS | Protocol | RFC 2818 of the Internet Engineering Task Force (IETF) describes the standard for HTTPS, using HTTP over Transport Layer Security (TLS).[7] |
| 2001 | July 26 | Wikipedia | HTTPS initial entry is created on English Wikipedia.[8] | ||
| 2003 | June | Standard | SNI | Protocol | RFS 3546 of the IETF describes a number of augmentations to TLS, including Server Name Indication (SNI).[9] |
| 2004 | April 1 | Webmail | Google (Gmail) | HTTPS availability | Gmail, Google's web-based email service, launches. The service is available over HTTPS right from the time of launch.[2] |
| 2004 | April 14 | Bugfix | Vulnerability exploit | Microsoft issues a fix for a bug in its SSL library that allows remote attackers to gain control of unpatched Windows 2000 and Windows NT4 servers offering encrypted services over the internet.[10] | |
| 2005 | April 20 | Microsoft | A blog post by Microsoft argues that using non-HTTPS login pages is insecure, even if the form submission is to a HTTPS page.[11][2] | ||
| 2005 | The CA/Browser Forum is founded. It is a voluntary consortium of certification authorities, vendors of Internet browser software, operating systems, and other PKI-enabled applications that promulgates industry guidelines governing the issuance and management of X.509 v.3 digital certificates that chain to a trust anchor embedded in such applications. | ||||
| 2006 | April | Standard | TLS 1.1 | Protocol | RFC 4346 defines TLS 1.1, the next version of TLS after TLS 1.0.[12] |
| 2008 | July 24 | Webmail | Google (Gmail) | Opt-in HTTPS-only | Google adds a setting in Gmail for users to always use HTTPS. Even before this, users could (since the inception of Gmail) access it securely by explicitly typing https:// in the browser. With the new setting, users who have opted in to it will be redirected from HTTP to HTTPS.[13][2] |
| 2008 | August | Standard | TLS 1.2 | Protocol | RFC 5246 defines TLS 1.2, the next version of TLS after TLS 1.1.[14] |
| 2010 | January 12 | Webmail | Google (Gmail) | Default HTTPS-only | Google switches all Gmail users to redirect to HTTPS; users can change their setings to not redirect to HTTPS. Previously, the default option for this setting was to not redirect, and users had to explicitly choose the option to redirect HTTP to HTTPS.[15][2] |
| 2010 | May 21 | Search engine | Google Search | HTTPS availability | Google makes search available on SSL at https://www.google.com. However, on June 25, they announced that they are moving encrypted search to https://encrypted.google.com because of challenges reported by school districts.[16][2] |
| 2010 | June 17 | Browser extension | HTTPS Everywhere | Security improvement | The Electronic Frontier Foundation and The Tor Project, Inc launch HTTPS Everywhere, a Firefox extension, to make Firefox use HTTPS where possible.[17] The extension would evolve over the coming years. As of 2017, it is supported on Firefox, Chrome, and Opera.[18] |
| 2010 | June 2 | Browser enhancement | SSL False Start | A Google team comprising Adam Langley, Nagendra Modadugu, and Bodo Moeller propose SSL False Start, a client-side only change to reduce one round-trip from the SSL handshake.[19][20][21] Despite tests showing that it reduces latency by 30%, the effort would be abandoned in April 2012 because of incompatibility with some servers doing early HTTPS termination.[22] | |
| 2010 | October | Browser extension | Firesheep | Vulnerability exploit | Firesheep, a Firefox browser extension that uses a packet analyzer to intercept unencrypted session cookies over Wi-Fi networks, is released. The extension highlights the need for greater security, both in terms of websites moving to HTTPS (end-to-end security) and improving security of Wi-Fi. |
| 2010 | October 14 | Proxy/load balancer | AWS Elastic Load Balancing | Early SSL termination | AWS Elastic Load Balancing announces support for SSL termination. This means that websites hosted on AWS, behind AWS load balancers, can upload their certificates to the load balancer, and have the load balancer take care of the SSL certificate, so that the servers that receive the actual traffic only have to handle HTTP traffic.[23] |
| 2010 | November 3 | Website | GitHub | Default HTTPS-only | In response to the release of Firesheep, GitHub moves to HTTPS for all users; previously full-session SSL was only available to paying users.[24] |
| 2010 | November 9 | Webmail | Hotmail (Microsoft) | Opt-in HTTPS-only | Microsoft lets users of its web-based email service, Hotmail, set HTTPS by default.[25][26] |
| 2011 | January | Website | Opt-in HTTPS-only | Facebook begins allowing logged-in users to opt in to have all their Facebook browsing encrypted by HTTPS.[27] | |
| 2011 | January | Standard | OCSP stapling | Protocol | RFC 6066, introducing OCSP stapling, is published.[28] OCSP stapling is an alternative approach to the Online Certificate Status Protocol that allows the presenter of a certificate to bear the resource cost involved in providing OCSP responses by appending ("stapling") a time-stamped OCSP response signed by the CA to the initial TLS handshake, eliminating the need for clients to contact the certificate authority. RFC 6961 would cover the case of multiple OCSP stapling.[29] |
| 2011 | March 15 | Website | Opt-in HTTPS-only | Twitter begins allowing logged-in users to opt in to have all their Twitter browsing encrypted by HTTPS.[30] | |
| 2011 | July 15 | Proxy/load balancer | Nginx | GlobalSign, DigiCert, Comodo and NGINX Inc. announce a joint effort to add OCSP-stapling support to Nginx.[31] | |
| 2011 | October 18 | Search engine | Google Search | Default HTTPS-only | Google makes HTTPS (using SSL) the default option for its search users who are logged in on google.com (its US site; regionally branded sites are not affected).[32][33][34] In particular, webmasters receiving traffic from Google Search will no longer be able to know the search terms that led to a specific visit.[35][36] |
| 2012 | February 13 | Website | Default HTTPS-only | Twitter makes HTTPS the default for all logged-in users.[37][38][39] | |
| 2012 | March | Search engine | Google Search | Default HTTPS-only | Google makes secure search the default globally for signed-in users. Previously, the change was limited to users on google.com.[40] |
| 2012 | July 31 | Webmail | Outlook (formerly Hotmail) (Microsoft) | Default HTTPS-only | With the rebranding of Hotmail as Outlook.com, Microsoft moves to default HTTPS-only for all usersof the web-based email service.[26] |
| 2012 | October 9 | Website | Quora | Opt-in HTTPS-only | On or before this date, question-and-answer website Quora allows logged-in users to opt in to HTTPS-only.[41] |
| 2012 | November | Website | Default HTTPS-only | Facebook rolls out its transition to HTTPS by default for all users, beginning with North America.[42][27] The move is reported to be completed on August 1, 2013.[43] | |
| 2012 | November 19 | Standard | RFC 6797 | Default HTTPS-only | The HTTP Strict Transport Security (HSTS) standard is published, after being approved on October 2.[44] The standard allows a website to set a header specifying a time period over which the client must connect to the website only via HTTPS. This protects against protocol downgrade attacks and cookie hijacking, and also avoids the extra latency involved in redirecting HTTP to HTTPS. |
| 2013 | February | The Certificate Authority Security Council is founded by the seven largest certificate authorities: Comodo, Symantec, Trend Micro, DigiCert, Entrust, GlobalSign, and GoDaddy. | |||
| 2013 | August 21 (actual release), August 1 (announcement) | Website | Wikipedia | Default HTTPS-only | Wikimedia Foundation turns on HTTPS for all logged-in users (announcement August 1).[45][46] |
| 2013 | September | Search engine | Google Search | Default HTTPS-only | Google Search moves all searches, even those by users who are not logged in, to HTTPS. The only exception is ad clicks. The change is believed to be a response to concerns about privacy triggered by relevations about PRISM, a United States federal government surveillance program.[47] |
| 2013 | September 26 | Website | Imgur | HTTPS available | Image-hosting service Imgur makes HTTPS available sitewide.[48] |
| 2013 | October 14 | Webmail | Yahoo! | Default HTTPS-only | Yahoo! Mail moves to a default of HTTPS-only.[26] |
| 2013 | October 24, 25 | Website | Internet Archive | Default HTTPS-only | The Internet Archive announces that its websites archive.org (which includes the Wayback Machine at web.archive.org) and openlibrary.org are defaulted to HTTPS-only, though they will still be available over HTTP.[49][50][51] |
| 2014 | January 22 | Search engine | Yahoo! | Default HTTPS-only | Yahoo! Search makes HTTPS-only the default. The change is initially rolled out on yahoo.com, but is expected to be rolled out to other regions as well.[52] |
| 2014 | January | Website | YouTube | Some move to HTTPS | YouTube begins sending traffic over HTTPS, significantly increasing the volume of traffic sent on the web via HTTPS. By September 2014, 50% of YouTube traffic would be sent via HTTPS.[53] |
| 2014 | February 3 | Website | Tumblr | Opt-in HTTPS-only | Tumblr gives blog owners the option of switching their blogs to HTTPS-only. NOTE: Unlike some other opt-in HTTPS-only implementations, the option is controlled by website owners rather than website visitors.[54] Internet security commentators feel that Tumblr didn't go far enough, and should have switched to default HTTPS-only.[55] |
| 2014 | March 5 | CDN | Amazon CloudFront | SNI custom SSL, HTTPS redirection | Amazon CloudFront announces support for customers to use their own SSL certificates through the implementation of Server Name Indication, as well as HTTP to HTTPS redirection (via 301 redirect). |
| 2014 | c.March 22 | Email service | Gmail | HTTPS adoption | Gmail goes 100% HTTPS.[56] |
| 2014 | June 5 | Website | WordPress | Default HTTPS-only | Automattic, the parent company of wordpress.com, announces that all wordpress.com subdomains will be moved to default HTTPS-only by the end of 2014.[57] |
| 2014 | July 29 | App | Default HTTPS-only | In response to reports about a zero-day security vulnerability, Instagram co-founder Mike Krieger reveals that the app is being moved over to HTTPS, with some parts of the app already 100% HTTPS.[58] | |
| 2014 | August 6 | Search ranking | Google Search | HTTPS boost | Google announces search results will give preference to sites using HTTPS. This added ranking signal would be a "lightweight" ranking boost.[59][60] |
| 2014 | September 8 | Website | Opt-in HTTPS-only | Reddit gives logged-in users the option of using the site purely on HTTPS.[61] | |
| 2014 | September 29 | CDN | Cloudflare | Default HTTPS-only | Cloudflare announces that it is rolling out universal SSL for all its users. This only affects connections to Cloudflare, and does not focre websites to upgrade their main site to HTTPS; however, all website owners are encouraged to upgrade their sites as well. In a blog post, Cloudflare CEO Matthew Prince explains the transition and the motivation behind it.[62] |
| 2014 | November 18 | Certificate authority | Let's Encrypt | Free HTTPS certificates | Let's Encrypt, a certificate authority service that can issue HTTPS certificates for three months for free (with some limitations on the types of certificate and the conditions under which certificates can be issued), is publicly announced. The service would issue its first certificate on September 14, 2015, and leave beta on April 12, 2016. |
| 2014 | December 18 | Browser | Chrome | Security warning | Google Chrome announces its intention of adding warnings for users visiting non-HTTPS websites.[63] More details are announced in late January 2015.[64] |
| 2015 | January 18 | Report/Observatory | HTTPSWatch | State of HTTPS adoption | The oldest Internet Archive snapshot of HTTPSWatch appears to be on this date. The snapshot says that it is inspired by Alex Gaynor's blog posts that were published in November and December 2014, so it is likely to be pretty close to the actual start date.[65][66][67] |
| 2015 | February | Browser | Chrome | HTTP/2 | Chrome begins rolling out support for HTTP/2. Chrome supports HTTP/2 only over HTTPS, even though the standard allows for HTTP/2 outside of HTTPS (through the selective use of encryption).[68] |
| 2015 | March 12 | Website/App | Default HTTPS-only | Pinterest announces that it has moved over to HTTPS, describing the challenges it faced along the way. With the increased security in place due to HTTPS, Pinterest also introduces a paid bug bounty program for the white hat hacker community to find security flaws.[69] | |
| 2015 | March 25 | Ecosystem | Advertising | Exhortation | Writing for the Interactive Advertising Bureau (IAB), Brendan Riordan-Butterworth calls for the advertising ecosystem to move to HTTPS.[70] |
| 2015 | April 13 | Browser | Firefox | Security warning | Mozilla announces plans to deprecate plain HTTP in their browser, Firefox.[71][72] |
| 2015 | May 19 | Website | Wikipedia | Site-wide censorship due to HTTPS transition | Likely starting around this day (judging from traffic volume), the Chinese government blocks Chinese Wikipedia.[73] The rationale is that, with Wikipedia's coming transition to HTTPS-only, the Chinese government will not be able to identify what page on the site a user is visiting, so blocking the whole site is the only way to implement the goal of blocking specific pages with politically sensitive content. See w:Censorship of Wikipedia#China for more details. |
| 2015 | June 8 | Website | United States government | Default HTTPS-only | The White House Office of Management and Budget issues the HTTPS-Only Standard directive requiring that all United States federal government websites provide service only via HTTPS, with a deadline of end of 2016.[74][75][76] |
| 2015 | June 12 | Website | Wikipedia | Default HTTPS-only | The Wikimedia Foundation publishes a blog post stating that all properties (including Wikipedia) are being switched over to HTTPS; previously, HTTPS was used only for logged-in users. It seems the switch is being made immediately.[77][78][79] |
| 2015 | June | Search engine | Bing | Default HTTPS-only | Microsoft announces that it will make HTTPS-only the default on Bing, its search engine.[80][81] |
| 2015 | June | Website | Default HTTPS-only | Reddit switches to HTTPS-only, with users being automatically redirected from HTTP to HTTPS.[82][83] | |
| 2015 | June 30 (deadline), April 17 (announcement) | Ad network | Google AdWords | HTTPS availability | As part of Google's HTTPS Everywhere initiative, Google AdWords announces, on April 17, some of it progress already made on moving ads to HTTPS (specifically, moving YouTube ads to HTTPS). Also, it is stated that the vast majority of mobile, video, and desktop display ads served to the Google Display Network, AdMob and DoubleClick publishers will be encrypted by June 30, and advertisers using any of the buying platforms, including AdWords and DoubleClick, will be able to serve HTTPS-encrypted display ads to all HTTPS-enabled inventory.[84] |
| 2015 | October 14 | Browser | Chrome | Mixed-content | With version 46, Chrome kills off its HTTP-HTTPS "mixed-content" address bar warning. Now, HTTPS pages that load some auxiliary resources (such as images, calls to ad networks, etc.) over HTTP will say https in the address bar without the secure lock or green coloring. The change is based on the idea that mixed HTTP-HTTPS is in fact more secure than pure HTTP, and therefore should not appear scarier, and is intended to "encourage site operators to switch to HTTPS sooner rather than later."[85][86] |
| 2016 | February | Website | Wikipedia | Referrer policy | The Wikimedia Foundation rolls out an update to the HTTPS meta referrer policy, that reveals the Origin rather than the full path of the referring domain. This means that websites that receive traffic from Wikipedia can once again calculate how much traffic they are receiving from Wikipedia, an ability that was lost in the switch to HTTPS. However, unlike the pre-HTTPS situation, full referral paths are not accessible, so websites cannot know what Wikipedia pages are sending traffic to them. For more, see Research:Wikimedia referrer policy.[87] |
| 2016 | March 15 | Report/Observatory | Google Transparency Report | State of HTTPS adoption | Google announces that it is adding a new section to its Transparency Report to track the progress of HTTPS adoption.[88][89][90] |
| 2016 | March 23 | Google provides a list of certificate authorities it does not trust.[91] | |||
| 2016 | February | Browser | Baidu Browser | Vulnerability exploit | The Citizen Lab publishes a report noting vulnerabilities in the Baidu Browser, a popular browser in China, some of which are related to the browser not using HTTPS fully.[92] |
| 2016 | March 28 | Browser | QQ Browser | Vulnerability exploit | The Citizen Lab publishes a report noting vulnerabilities in the QQ Browser, a popular browser in China, some of which are related to the browser not using HTTPS fully.[93] |
| 2016 | April 8 | Website | WordPress | Default HTTPS-only | Automattic, the owner of WordPress.com, announces that WordPress custom domains will be switched to default HTTPS-only. Previously, HTTPS-only was enabled only on subdomains of wordpress.com.[94] |
| 2016 | April 28 (first announcement), August 15 (completion) | Website | WIRED | Default HTTPS-only | On April 28, WIRED announces that its website is going HTTPS-only. The article announcing the transition explains the challenges involved in making sure every digital asset loaded on every page is HTTPS.[95] The transition is announced to be complete on August 15.[96] |
| 2016 | June 14 | App store service | Apple | Default HTTPS-only | At the Apple Worldwide Developers Conference, Apple announces that it will require all iOS apps to use HTTPS connections by the end of 2016.[97] |
| 2016 | June 15 | Website | TechCrunch | Default HTTPS-only | Technology new website TechCrunch announces that it has gone HTTPS-only.[98] |
| 2016 | August 1 | Website | YouTube | State of HTTPS adoption | YouTube announces that it serves 97% of traffic over HTTPS.[99] |
| 2016 | August | Website | Netflix | Default HTTPS-only | Netflix announces that it is adding TLS encryption to all its video streams, and expects to finish the process by year-end.[100][101] |
| 2016 | August 25 | Report/Observatory | Mozilla | State of HTTPS adoption | Mozilla, the organization that manages the Firefox browser, creates the Mozilla Observatory to track the web and its security. Among other things, this tracks the state of HTTPS adoption.[102][103] |
| 2016 | September (completion), November 29 (announcement) | Website | The Guardian | Default HTTPS-only | The Guardian announces that it completed its migration to HTTPS-only about two months ago. The announcement post describes the challenges of the migration, including avoiding negative audience and revenue impacts, and keeping older interactive content working. The migration approach is summarized as: migrate one small audience section to HTTPS, identify the problems and track them, and fix the problems that need to be fixed before the next section migration. Three complementary techniques used: monitoring, decoupling backend and frontend migrations (with backend migrations done first), and usage of early adopters (users could opt in to HTTPS-only before moving to default HTTPS-only). Technical details of the migration are also included in the post.[104] |
| 2016 | October 23 | Website | neverssl.com is registered.[105] Motivated by the existence of broken "Wifi capture" networks that don't work well with HTTPS, the site is created "to make logging on a little bit easier".[106]
| ||
| 2017 | January 10 | Website | New York Times | Default HTTPS-only | The New York Times announces that it has made a number of its articles default to HTTPS, including the home page, section and topic pages, and all articles published 2014 or later, and that it plans to make the rest of its site HTTPS as well.[107] |
| 2017 | January 21 | Guideline | American Library Association | HTTPS use guideline | The American Library Association publishes a library privacy checklist approved by its intellectual freedom committee. The checklist mentions HTTPS twice. In priority 1 actions, it includes an action "Ensure all existing security certificates for HTTPS/SSL are valid and create a procedure for revalidating them annually." In priority 2 actions, it includes an action "Utilize HTTPS wherever possible." (Ironically, even as of April 2019, the American Library Association website does not properly support HTTPS, with the HTTPS site redirecting to the HTTP site).[108] |
| 2017 | January 25 | Website | Ars Technica | Default HTTPS-only | Ars Technica announces that it has switched to default HTTPS-only, and explains details of the move.[109] |
| 2017 | January | Browser | Chrome | Security warning | With version 56, Google Chrome begins marking as "Not Secure" (in the address bar) any webpages collecting sensitive data such as passwords or credit-card information without using HTTPS.[110][111] |
| 2017 | January 4 | Website | National Public Radio | Default HTTPS-only | National Public Radio announces that it has transitioned most of its webpages and streaming content to HTTPS, and is making sure that any new content is served through HTTPS.[112] |
| 2017 | January 10 | Website | W Magazine | Default HTTPS-only | A post on the Condé Nast technology blog, describes the transition of W Magazine, a Conde Nast property, to HTTPS.[113] |
| 2017 | March 30 | Website | Pornhub | Default HTTPS-only | Pornhub, the world's largest pornographic video site, switches to HTTPS-only. Sister service YouPorn is scheduled to go HTTPS-only on April 4.[114][115] |
| 2017 | May 22 | Website | Stack Overflow | Default HTTPS-only | Stack Overflow announces that it has migrated to HTTPS, after four years of work on the migration. All other Stack Exchange websites are also moved over to HTTPS.[116][117] |
| 2017 | May through August 16 | Website | Springer-Verlag | Default HTTPS-only | Publisher Springer transitions its websites to HTTPS, with HTTP redirecting to HTTPS.[118][119] |
| 2017 | September 11 | The Google Security Blog announces Google Chrome's finalized plans to distrust certificates issued by Symantec.[120] The SSL Store blogs about it with some commentary explaining the controversy.[121] | |||
| 2017 | September 13 | Website | Imgur | Default HTTPS-only | Image-hosting service Imgur defaults to HTTPS-only for all users (both logged-in and others).[122] |
| 2017 | October | Browser | Chrome | Security warning | Starting with version 62, Chrome begins marking all non-HTTPS webpages as "Not Secure" for users in incognito mode.[111] |
| 2017 | Report | Research at Google | State of HTTPS adoption | Research at Google publishes a paper titled Measuring HTTPS adoption on the web.[123][124] | |
| 2017 | Standard | TLS 1.3 | Protocol | The standard for TLS 1.3 is under discussion, but not finalized. Browsers support it for a while as the default but then stop due to issues. See w:Transport Layer Security#TLS_1.3_.28draft.29 for more. As of the end of 2017, TLS 1.3 is still not ready.[125] | |
| 2017 | December 30 | nonhttps.com<code/> is registered.[126] Similar to <code>neverssl.com, the site is created to for websites to "guarantee that they will always remain accessible by HTTP".[127]
| |||
| 2018 | February 27 | Certificate authority | Let's Encrypt | Wildcard support | Let's Encrypt plans to make wildcard support fully available on this date, after launching a public test API endpoint for the ACME v2 protocol and wildcard support on January 4, 2018.[128] |
| 2018 | April 1 | CDN | Cloudflare | Secure DNS resolver | Cloudflare launches 1.1.1.1, a secure DNS resolver that uses both DNS-over-TLS and DNS-over-HTTPS.[129] |
| 2018 | April 14 | Website | IMDb | Default HTTPS-only | Judging from homepage captures on the Internet Archive's Wayback Machine, this is the date that the IMDb transitions from HTTP to default HTTPS-only. See captures for April 13[130] and April 14.[131] There does not appear to be any official announcement of the transition, but a Quora question with answers as late as February 2018 confirms that people noticed that the site was still using plain HTTP till February 2018.[132] |
| 2018 | June (completion), July 9 (announcement) | Website | BBC | Default HTTPS-only | In a blog post on July 9, 2018, software engineer James Donohue announces that the BBC has completed transitioning its website to HTTPS-only a few weeks ago. The blog post explains some of the technical challenges of migrating the site (which has news content from as far back as 1997, when the site first went online), and the steps involved in completing the migration.[133] |
| 2018 | July 24 | Website | Whynohttps | Security warning | whynohttps.com launches as a project that tracks the world's largest websites not implementing HTTPS by default.[134][135]
|
| 2018 | July (planned date), February 8 (announcement) | Browser | Chrome | Security warning | On February 8, Google Chrome announces that starting with Chrome 68, which will be released in July, all plain HTTP sites will be marked as not secure.[136][137][138] The release happens as scheduled. Forbes publishes an article naming a few sites that still do not default to HTTPS as of the time of this change to Chrome. The sites include Fox News, the Los Angeles Times, Chicago Tribune, Time, ESPN, NFL Network, NBA, and more. Some of these sites, such as Time and ESPN, still do not default to HTTPS as of April 2019.[139] |
| 2018 | August 7 | Website | BBC | Site-wide censorship due to HTTPS adoption | The BBC website is blocked in China shortly after it migrated to HTTPS-only. For HTTPS websites, it is not possible for intermediaries in the network to identify individual pages being browsed, so the Chinese government needs to block the whole site in order to block access to politically sensitive content.[140] |
| 2018 | September 24 | CDN | Cloudflare | Support for encrypted SNI | Cloudflare announces that it is beginning support of encrypted SNI.[141][142] |
| 2018 | October 18 | Browser | Firefox | Support for encrypted SNI | Firefox announces support for encrypted SNI in the Firefox Nightly build.[143][144] |
| 2018 | c.November 17 | Calendar service | Google Calendar | HTTPS adoption | Google Calendar goes 100% HTTPS.[56] |
| 2019 | January to February; with some early test efforts in October 2018, and some wrap-up work as late as April 11 | Website | Wikia / Fandom | Default HTTPS-only | Fandom Inc., the company previously known as Wikia, moves the bulk of their community wikis from HTTP to HTTPS, while also changing the domain from wikia.com to fandom.com (to be more consistent with the company's new name and branding). Some domains that do not fit with the Fandom brand are moved to wikia.org instead; these are also migrated to HTTPS.[145] |
| 2019 | August | Browser | Chrome | Interface simplification | With Chrome 76, Google stops showing the leading https and www on urls in the address bar; however, these are shown if you click into the address bar twice. The Chrome team says that this simplifies the experience for most users by removing information that's not relevant to them, but there is some pushback to these claims from people who believe the information is important and should be readily visible.[146] Users can still determine if a site is secure by looking for the lock icon; insecure sites will be marked "Not Secure". |
| 2019 | c.September 28 | Online advertising platform | Google Ads | HTTPS adoption | Google Ads goes 100% HTTPS.[56] |
| 2019 | c.September | Online video platform | Youtube | HTTPS adoption | Youtube goes 100% HTTPS.[56] |
Numerical and visual data
Google Scholar
The following table summarizes per-year mentions on Google Scholar as of June 10, 2021.
| Year | http | https | https security | https adoption |
|---|---|---|---|---|
| 1980 | 145,000 | 196,000 | 33,400 | 4,120 |
| 1985 | 153,000 | 219,000 | 13,800 | 4,460 |
| 1990 | 183,000 | 309,000 | 54,200 | 5,880 |
| 1995 | 341,000 | 436,000 | 19,600 | 7.320 |
| 2000 | 1,520,000 | 1,300,000 | 68,600 | 14,400 |
| 2002 | 1,430,000 | 1,360,000 | 41,000 | 19,500 |
| 2004 | 2,360,000 | 1,650,000 | 82,300 | 37,600 |
| 2006 | 2,530,000 | 1,730,000 | 132,000 | 70,700 |
| 2008 | 2,620,000 | 1,800,000 | 172,000 | 102,000 |
| 2010 | 2,610,000 | 2,020,000 | 271,000 | 130,000 |
| 2012 | 2,650,000 | 2,240,000 | 365,000 | 166,000 |
| 2014 | 2,310,000 | 2,230,000 | 481,000 | 187,000 |
| 2016 | 1,950,000 | 1,870,000 | 606,000 | 179,000 |
| 2017 | 1,760,000 | 1,690,000 | 602,000 | 190,000 |
| 2018 | 1,590,000 | 1,570,000 | 480,000 | 172,000 |
| 2019 | 901,000 | 1,200,000 | 319,000 | 140,000 |
| 2020 | 444,000 | 635,000 | 198,000 | 87,600 |
Google Trends
The comparative chart below shows Google Trends data HTTPS (Search term) and HTTP (Search term), from March 2004 to March 2021, when the screenshot was taken. Interest is also ranked by country and displayed on world map.[147]
Google Ngram Viewer
The chart below shows Google Ngram Viewer data for HTTPS and HTTP, from 1989 to 2019.[148]
Wikipedia Views
The chart below shows pageviews of the English Wikipedia article HTTPS on desktop from December 2007, and on mobile-web, desktop-spider,mobile-web-spider and mobile app, from July 2015; to January 2021.[149]
Meta information on the timeline
How the timeline was built
The initial version of the timeline was written by User:Vipul.
What the timeline is still missing
- DNS over HTTPS: RFC
- DNS over TLS
- Encrypted SNI: Draft standard
Timeline update strategy
- Keep pace with the latest developments in HTTPS
- Look for articles about websites and services transitioning to HTTPS
- Use the Wayback Machine to identify dates of transition to HTTPS
See also
- History of HTTPS Usage by Jeff Kaufman
References
- ↑ Sprout, Alison (July 1, 1995). "The rise of Netscape". Retrieved March 11, 2018.
- ↑ 2.0 2.1 2.2 2.3 2.4 2.5 2.6 Kaufman, Jeff (March 8, 2018). "History of HTTPS Usage". Retrieved March 11, 2018.
- ↑ "Netscape: Internet security flaw can be fixed.". September 19, 1995. Retrieved March 11, 2018.
- ↑ Markoff, John (October 16, 1995). "The New Watchdogs of Digital Commerce". New York Times. Retrieved March 11, 2018.
- ↑ "The Secure Sockets Layer (SSL) Protocol Version 3.0". Internet Engineering Task Force. August 1, 2011. Retrieved November 23, 2017.
- ↑ "The TLS Protocol Version 1.0". Internet Engineering Task Force. January 1, 1999. Retrieved November 23, 2017.
- ↑ "HTTP Over TLS". Internet Engineering Task Force. May 1, 2000. Retrieved November 23, 2017.
- ↑ "HTTPS: Revision history". en.wikipedia.org. Retrieved 1 March 2020.
- ↑ "Transport Layer Security (TLS) Extensions". Internet Engineering Task Force. June 1, 2003. Retrieved November 20, 2017.
- ↑ "Microsoft SSL Vulnerability gives attackers opportunity to gain control of leading banking sites". Netcraft. April 14, 2004. Retrieved March 11, 2018.
- ↑ "TLS and SSL in the real world". April 20, 2005. Retrieved March 11, 2018.
- ↑ "The Transport Layer Security (TLS) Protocol Version 1.1". Internet Engineering Task Force. April 1, 2006. Retrieved November 23, 2017.
- ↑ Rideout, Ariel (July 24, 2008). "Making security easier". Google. Retrieved November 19, 2017.
- ↑ "The Transport Layer Security (TLS) Protocol Version 1.2". Internet Engineering Task Force. August 1, 2008. Retrieved November 23, 2017.
- ↑ Schillace, Sam (January 12, 2010). "Default https access for Gmail". Google. Retrieved November 19, 2017.
- ↑ Roseman, Evan (May 21, 2010). "Search more securely with encrypted Google web search". Google Official Blog. Retrieved March 11, 2018.
- ↑ Eckersley, Peter (June 17, 2010). "Encrypt the Web with the HTTPS Everywhere Firefox Extension". Electronic Frontier Foundation. Retrieved November 19, 2017.
- ↑ "HTTPS Everywhere". Retrieved November 19, 2017.
- ↑ "Transport Layer Security (TLS) False Start". Internet Engineering Task Force. June 2, 2010. Retrieved November 19, 2017.
- ↑ "SSL FalseStart Performance Results". Chromium blog. May 18, 2011. Retrieved November 19, 2017.
- ↑ "Changing HTTPS". Imperial Violet. September 5, 2010. Retrieved November 19, 2017.
- ↑ Goodin, Dan (April 12, 2012). "False Start's sad demise: Google abandons noble attempt to make SSL less painful". Retrieved November 19, 2017.
- ↑ Barr, Jeff (October 14, 2010). "AWS Elastic Load Balancing: Support for SSL Termination". Amazon Web Services. Retrieved November 19, 2017.
- ↑ "GitHub moves to SSL, but remains Firesheepable". Netcraft. November 3, 2010. Retrieved November 20, 2017.
- ↑ Mills, Elinor (November 9, 2010). "Microsoft lets Hotmail users set encryption by default. Microsoft adds full-session encryption option to HOtmail and SSL for SkyDrive, Photos, Docs, and Devices pages.". CNet. Retrieved November 20, 2017.
- ↑ 26.0 26.1 26.2 Peterson, Andrea; Gellman, Barton; Soltani, Ashkan (October 14, 2013). "Yahoo to make SSL encryption the default for Webmail users. Finally.". Retrieved November 20, 2017.
- ↑ 27.0 27.1 Constine, Josh (November 18, 2012). "Facebook Could Slow Down A Tiny Bit As It Starts Switching All Users To Secure HTTPS Connections". TechCrunch. Retrieved November 19, 2017.
- ↑ "Transport Layer Security (TLS) Extensions: Extension Definitions". January 1, 2011. Retrieved November 19, 2017.
- ↑ "The Transport Layer Security (TLS) Multiple Certificate Status Request Extension". June 1, 2013. Retrieved November 19, 2017.
- ↑ "Making Twitter more secure: HTTPS". Twitter. March 15, 2011. Retrieved November 19, 2017.
- ↑ "GlobalSign, DigiCert and Comodo Collaborate with NGINX to Improve Online Trust through Enhanced Certificate Revocation Checking, sign a Sponsorship Agreement. New version of the popular NGINX web server to support OCSP-stapling". NGINX, Inc. July 15, 2011. Retrieved November 19, 2017.
- ↑ "Making search more secure". Google. October 18, 2011. Retrieved November 19, 2017.
- ↑ Boulton, Clint (October 18, 2011). "Google Makes HTTPS Encryption Default for Search". eweek. Retrieved November 19, 2017.
- ↑ Sullivan, Danny (October 18, 2011). "Google To Begin Encrypting Searches & Outbound Clicks By Default With SSL Search". Search Engine Land. Retrieved November 19, 2017.
- ↑ "Making search more secure: Accessing search query data in Google Analytics". October 18, 2011. Retrieved November 19, 2017.
- ↑ Sullivan, Danny (October 22, 2011). "Google Puts A Price On Privacy". Retrieved November 19, 2017.
- ↑ "Securing your Twitter experience with HTTPS". Twitter. February 13, 2012. Retrieved November 19, 2017.
- ↑ "Should All Web Traffic Be Encrypted?". Coding Horror. February 23, 2012. Retrieved November 19, 2017.
- ↑ Brinkmann, Martin (February 14, 2012). "Twitter Makes HTTPS Default For Signed In Users". Retrieved November 19, 2017.
- ↑ "Bringing more secure search around the globe". March 5, 2012. Retrieved November 19, 2017.
- ↑ Cook, Tom (October 9, 2012). "Does Quora support HTTPS? Tom Cook's answer log". Retrieved November 20, 2017.
- ↑ Asthana, Shireesh (November 15, 2012). "Platform Updates: Operation Developer Love". Facebook. Retrieved November 19, 2017.
- ↑ "Secure browsing by default". August 1, 2013. Retrieved November 20, 2017.
- ↑ "HTTP Strict Transport Security (HSTS)". November 19, 2012. Retrieved November 19, 2017.
- ↑ Lane, Ryan (August 1, 2013). "The future of HTTPS on Wikimedia projects". Wikimedia Foundation. Retrieved September 25, 2016.
- ↑ Eaton, Kit (August 2, 2013). "After NSA's XKeyscore, Wikipedia Switches To Secure HTTPS. The Wikimedia Foundation has announced it's pushing ahead with plans to secure its online systems due to NSA targeting.". Fast Company. Retrieved September 25, 2016.
- ↑ Sullivan, Danny (September 23, 2013). "Post-PRISM, Google Confirms Quietly Moving To Make All Searches Secure, Except For Ad Clicks". Retrieved November 20, 2017.
- ↑ "100 MILLION UNIQUES, HIGHER UPLOAD LIMITS, AND HTTPS SUPPORT". September 26, 2013. Retrieved November 20, 2017.
- ↑ Kahle, Brewster (October 25, 2013). "Reader Privacy at the Internet Archive". Retrieved November 19, 2017.
- ↑ Streitfeld, David (October 24, 2013). "Internet Archive Will Shield Visitors". New York Times Bits Blog. Retrieved November 19, 2017.
- ↑ Protalinski, Emil (October 25, 2013). "With over 3 million users per day, the Internet Archive switches to HTTPS connections by default". The Next Web. Retrieved November 19, 2017.
- ↑ Sullivan, Danny (January 22, 2014). "Yahoo Makes Secure Search The Default". MarketingLand. Retrieved November 20, 2017.
- ↑ Naylor, David; Finamore, Alessandro; Leontiadis, Ilias; Grunenberger, Yan; Mellia, Marco; Munafo, Maurizio; Papagiannaki, Konstantina; Steenkiste, Peter. "The Cost of the "S" in HTTPS" (PDF).
- ↑ "You can now take extra precaution against hackers and snoops by enabling SSL security on your Tumblr Dashboard.". Tumblr. February 3, 2014. Retrieved April 13, 2019.
- ↑ "Tumblr activates SSL, but with a catch. Tumblr blog owners can encrypt all visits to their sites, as long as they opt in. Why didn't Yahoo just make SSL the default setting?". February 3, 2014. Retrieved April 13, 2019.
- ↑ 56.0 56.1 56.2 56.3 "HTTPS encryption on the web". transparencyreport.google.com. Retrieved 1 March 2020.
- ↑ Siemenski, Paul (June 5, 2014). "Reset the Net. If we properly encrypt our sites and devices, we can make mass surveillance much more difficult. We'll be serving pages only over SSL for all *.wordpress.com subdomains by the end of the year.". The WordPress.com Blog. Retrieved December 1, 2019.
- ↑ "Instagram to use HTTPS following discovery of gaping security hole in iOS app. Security expert warns users should not use the app until a patch is released". The Inquirer. July 29, 2014. Retrieved November 19, 2017.
- ↑ "HTTPS as a ranking signal". www.google.com. Retrieved Dec 1, 2014.
- ↑ Russell, Jon (August 7, 2014). "Google is now ranking websites with HTTPS higher in its search results". The Next Web. Retrieved November 19, 2017.
- ↑ "Hell, It's About Time – reddit now supports full-site HTTPS". Reddit. September 8, 2014. Retrieved November 19, 2017.
- ↑ Prince, Matthew (September 29, 2014). "Introducing Universal SSL". Cloudflare. Retrieved December 1, 2019.
- ↑ Slegg, Jennifer (December 18, 2014). "Google Chrome Wants to Warn Users Before Visiting All Non-HTTPS Sites". The SEM Post. Retrieved November 20, 2017.
- ↑ Slegg, Jennifer (January 28, 2015). "First Look at How Google Chrome Plans to Alert Users to Non-HTTPS Websites". Retrieved November 20, 2017.
- ↑ "HTTPSWatch (About section)". Retrieved January 18, 2015.
- ↑ Gaynor, Alex (November 12, 2015). "The State of the News and TLS". Retrieved November 20, 2015.
- ↑ Gaynor, Alex (December 30, 2014). "The State of the News and TLS: Part II". Retrieved November 20, 2017.
- ↑ "Hello HTTP/2, Goodbye SPDY". Chromium. February 9, 2015. Retrieved November 19, 2017.
- ↑ Moreno, Paul (March 12, 2015). "Making Pinterest HTTPS". Pinterest Engineering via Medium. Retrieved November 20, 2017.
- ↑ Riordan-Butterworth, Brendan (March 25, 2015). "Adopting Encryption: The Need for HTTPS". Interactive Advertising Bureau. Retrieved November 20, 2017.
- ↑ Barnes, Richard (April 13, 2015). "Intent to deprecate: Insecure HTTP". Retrieved November 20, 2017.
- ↑ "Mozilla Announces Plans to Deprecate HTTP in Firefox". The SEM Post. April 16, 2015. Retrieved November 20, 2017.
- ↑ "Aggregate page counts for traffic to Chinese Wikipedia for May 2015". Retrieved April 13, 2019.
- ↑ Scott, Tony (June 8, 2015). "Policy to Require Secure Connections across Federal Websites and Web Services" (PDF). Retrieved November 20, 2017.
- ↑ Scott, Tony (June 8, 2015). "HTTPS-Everywhere for Government". Obama White House Archives. Retrieved November 20, 2017.
- ↑ Williams, Martyn (June 8, 2015). "US to require HTTPS for all government websites. All public sites will be required to use the protocol by the end of 2016". Retrieved November 20, 2017.
- ↑ Welinder, Yana; Baranetsky, Victoria; Black, Brandon (June 12, 2015). "Securing access to Wikimedia sites with HTTPS". Wikimedia Foundation. Retrieved September 25, 2016.
- ↑ Thomas, Karl (June 15, 2015). "Wikipedia switches to HTTPS by default". WeLiveSecurity. Retrieved September 25, 2016.
- ↑ Farivar, Cyrus (June 15, 2015). "Wikipedia goes all-HTTPS, starting immediately. "We believe that the time for HTTPS by default is now."". ArsTechnica. Retrieved September 25, 2016.
- ↑ "Bing Moving to Encrypt Search Traffic by Default". Bing. June 15, 2015. Retrieved November 20, 2017.
- ↑ Schick, Shane (June 22, 2015). "Microsoft to Make HTTPS a Default Setting for Bing". Retrieved November 20, 2017.
- ↑ Lorenzo Franceschi-Bicchierai (June 17, 2015). "Reddit Switches to Encryption By Default. The internet giant will switch to HTTPS by default by the end of the month.". Vice. Retrieved November 19, 2017.
- ↑ "reddit will soon only be available over HTTPS (self.redditdev)". Reddit. June 16, 2015. Retrieved November 19, 2017.
- ↑ "Ads Take a Step Towards "HTTPS Everywhere"". Google AdWords. April 17, 2015. Retrieved November 20, 2017.
- ↑ Anthony, Sebastian (October 14, 2015). "Chrome finally kills off the HTTP-HTTPS "mixed content" warning. Slightly alarming and not wholly useful yellow triangle is being retired.". Retrieved November 20, 2017.
- ↑ Whittaker, Zack (October 14, 2015). "Chrome 46 loosens up on HTTPS 'mixed content' warnings. The browser -- known for being a bit overkill -- finally drops its yellow-warning attached to pages with both secure and non-secure content.". Retrieved November 19, 2017.
- ↑ "Set an explicit "Origin When Cross-Origin" referer policy via the meta referrer tag". August 18, 2015. Retrieved March 10, 2017.
- ↑ "Securing the web, together". Google Security Blog. March 15, 2016. Retrieved November 19, 2017.
- ↑ Schwartz, Barry (March 16, 2016). "Google Report On HTTPS Adoption Within Google & The Top Web Sites". Search Engine Roundtable. Retrieved November 19, 2017.
- ↑ "Google's Transparency Report to Include HTTPS Adoption Rates". Search Engine Journal. March 25, 2016. Retrieved November 19, 2017.
- ↑ Chirgwin, Richard (March 23, 2016). "Google publishes list of Certificate Authorities it doesn't trust. Thawte experiment aims to expose issuers of dodgy creds". The Register. Retrieved November 20, 2017.
- ↑ Gillis, Alex (February 26, 2016). "Researchers find privacy problems in popular Baidu browser". Retrieved April 13, 2019.
- ↑ Knockel, Jeffrey; Senft, Adam; Deibert, Ron (March 28, 2016). "Privacy and Security Issues in QQ Browser". The Citizen Lab. Retrieved April 13, 2019.
- ↑ Barry (April 8, 2016). "HTTPS Everywhere: Encryption for All WordPress.com Sites. We're proud to support a more secure web — now for all custom domains on WordPress.com.". The WordPress.com Blog. Retrieved December 1, 2019.
- ↑ Tollman, Zack (April 28, 2016). "WE'RE GOING HTTPS: HERE'S HOW WIRED IS TACKLING A HUGE SECURITY UPGRADE". WIRED. Retrieved February 11, 2018.
- ↑ Tollman, Zack (August 15, 2016). "How WIRED Completely Encrypted Itself". Retrieved December 1, 2019.
- ↑ Conger, Kate (June 14, 2016). "Apple will require HTTPS connections for iOS apps by the end of 2016". TechCrunch. Retrieved February 11, 2018.
- ↑ Wilke, Nicole (June 15, 2016). "TechCrunch has gone HTTPS". Retrieved November 19, 2017.
- ↑ "YouTube's road to HTTPS". YouTube. August 1, 2016. Retrieved November 19, 2017.
- ↑ "Protecting Netflix Viewing Privacy at Scale". Netflix on Medium. August 8, 2016. Retrieved November 19, 2017.
- ↑ "Netflix explains how and why it's switching to HTTPS streaming. Adding encryption increases privacy for viewers -- and for Netflix.". August 9, 2016. Retrieved November 19, 2017.
- ↑ King, April (April 25, 2016). "Observatory by Mozilla: Making the Web Safer". Retrieved November 20, 2017.
- ↑ Paganini, Pierluigi (August 27, 2016). "Mozilla launched the Observatory tool to test the security of websites". Retrieved November 20, 2017.
- ↑ Chauvin, Mariot; Islam, Huma (November 29, 2016). "The Guardian has moved to HTTPS. Discover why and how the Guardian has moved to HTTPS, the secure version of the web protocol that helps to protect user privacy". The Guardian. Retrieved April 13, 2019.
- ↑ "neverssl.com". who.is. Retrieved 24 February 2020.
- ↑ "NeverSSL". neverssl.com/. Retrieved 24 February 2020.
- ↑ Konigsburg, Eitan; Wan, Vinessa (January 1, 2010). "HTTPS on NYTimes.com". New York Times Open blog. Retrieved November 19, 2017.
- ↑ "Library Privacy Checklist - Overview". American Library Association. January 21, 2017. Retrieved April 13, 2019.
- ↑ Hutchinson, Lee (January 25, 2017). "Ars announces HTTPS by default (finally). Doing our part to push the encrypted-by-default vision of the Web.". Ars Technica. Retrieved December 1, 2019.
- ↑ Murray, Brock (January 21, 2017). "Google Is Requiring HTTPS for Secure Data in Chrome". Retrieved November 19, 2017.
- ↑ 111.0 111.1 Tung, Liam (April 28, 2017). "Google tightens noose on HTTP: Chrome to stick 'Not secure' on pages with search fields. In October, Google will begin phase two of its plan to label all HTTP pages as non-secure.". ZDNet. Retrieved November 15, 2017.
- ↑ Faughan, Kate (January 4, 2017). "Update to the HTTPS Transition for Streams and Podcasts". National Public Radio. Retrieved February 11, 2018.
- ↑ Colucci, David (July 10, 2017). "Securing W Magazine: Our Migration to HTTPS". Retrieved December 1, 2019.
- ↑ Barrett, Brian (March 30, 2017). "THE WORLD'S BIGGEST PORN SITE GOES ALL-IN ON ENCRYPTION". Wired. Retrieved November 9, 2017.
- ↑ Garun, Natt (March 30, 2017). "Pornhub now turns on encryption by default". The Verge. Retrieved November 19, 2017.
- ↑ Craver, Nick (May 22, 2017). "HTTPS on Stack Overflow: The End of a Long Road". Retrieved November 19, 2017.
- ↑ Taylor, Anita (May 22, 2017). "How Stack Overflow Flipped the Switch on HTTPS". Stack Overflow. Retrieved November 19, 2017.
- ↑ "360 Link: Springer Transition to https -- effective August 16, 2017". ExLibris Knowledge Center. August 7, 2017. Retrieved February 11, 2017.
- ↑ "Switching to HTTPS". Springer Online Service on Freshdesk. September 6, 2017. Retrieved February 11, 2018.
- ↑ O'Brien, Devon; Sleevi, Ryan; Whalley, Andrew (September 11, 2017). "Chrome's Plan to Distrust Symantec Certificates". Google Security Blog. Retrieved April 13, 2019.
- ↑ "Official: Google Chrome's Plan to Distrust Symantec SSL Certificates The announcement being circulated simply finalizes an agreement from July". The SSL Store. September 13, 2017. Retrieved April 13, 2019.
- ↑ "Defaulting to https (01-XX-2015) - Request fulfilled as of 09-13-2017!". January 29, 2015. Retrieved November 20, 2017.
- ↑ Feit, Adrienne Porter; Barnes, Richard; King, April; Palmer, Chris; Bentzel, Chris; Tabriz, Parisa. "Measuring HTTPS adoption on the web". Retrieved November 20, 2017.
- ↑ Feit, Adrienne Porter; Barnes, Richard; King, April; Palmer, Chris; Bentzel, Chris; Tabriz, Parisa. "Measuring HTTPS adoption on the web" (PDF). Retrieved November 20, 2017.
- ↑ Sullivan, Nick (December 26, 2017). "Why TLS 1.3 isn't in browsers yet". Cloudflare. Retrieved January 28, 2018.
- ↑ "nonhttps.com". who.is. Retrieved 24 February 2020.
- ↑ "HTTPS". wikivisually.com. Retrieved 24 February 2020.
- ↑ Aas, Josh (July 6, 2017). "Wildcard Certificates Coming January 2018". Let's Encrypt. Retrieved January 28, 2018.
- ↑ Prince, Matthew (April 1, 2018). "Announcing 1.1.1.1: the fastest, privacy-first consumer DNS service". Cloudflare. Retrieved December 1, 2019.
- ↑ "IMDb, as captured on April 13, 2018". April 13, 2018. Retrieved April 13, 2019.
- ↑ "IMDb, as captured on April 14, 2018". April 14, 2018. Retrieved April 13, 2019.
- ↑ "Why does IMDB use http and not HTTPS?". Quora. Retrieved April 13, 2019.
- ↑ Donohue, James (July 9, 2018). "BBC News on HTTPS". BBC. Retrieved April 13, 2019.
- ↑ "Why No HTTPS? Here's the World's Largest Websites Not Redirecting Insecure Requests to HTTPS". troyhunt.com. Retrieved 24 February 2020.
- ↑ "Still Why No HTTPS?". troyhunt.com. Retrieved 24 February 2020.
- ↑ Schechter, Emily (February 8, 2018). "A secure web is here to stay". Google Security Blog. Retrieved February 11, 2018.
- ↑ Lardinois, Frederic (February 8, 2018). "Chrome will soon mark all unencrypted pages as 'not secure'". TechCrunch. Retrieved February 11, 2018.
- ↑ Bright, Peter (February 9, 2018). "From July on, Chrome will brand plain old HTTP as "Not secure". The "Not secure" label will go where the padlock would go for an encrypted connection.". ArsTechnica. Retrieved February 11, 2018.
- ↑ Murnane, Kevin (July 25, 2018). "Fox News, ESPN And 9 Other Well-Known Websites That Chrome 68 Labels 'Not Secure'". Forbes. Retrieved April 13, 2019.
- ↑ "BBC websites blocked in China after security change". August 7, 2018. Retrieved April 13, 2019.
- ↑ Prince, Matthew (September 24, 2018). "Encrypting SNI: Fixing One of the Core Internet Bugs". Cloudflare. Retrieved December 1, 2019.
- ↑ Ghedini, Alessandro (September 24, 2018). "Encrypt it or lose it: how encrypted SNI works". Cloudflare. Retrieved December 1, 2019.
- ↑ Rescorla, Eric (October 18, 2018). "Encrypted SNI Comes to Firefox Nightly". Mozilla. Retrieved December 1, 2019.
- ↑ "Encrypt that SNI: Firefox edition". Cloudflare. October 18, 2018. Retrieved December 1, 2019.
- ↑ "Help:Fandom domain migration". Fandom Community Central. Retrieved April 13, 2019.
- ↑ Brinkmann, Martin (August 16, 2019). "Chrome 76: no more https or www in address bar". Retrieved December 1, 2019.
- ↑ "HTTPS and HTTP". Google Trends. Retrieved 14 March 2021.
- ↑ "HTTPS and HTTP". books.google.com. Retrieved 14 March 2021.
- ↑ "HTTPS". wikipediaviews.org. Retrieved 24 February 2021.
