Timeline of HTTPS adoption

From Timelines
Revision as of 16:35, 19 November 2017 by Vipul (talk | contribs)
Jump to: navigation, search

This timeline describes the gradual increase in websites and clients using HTTPS.

Full timeline

Year Month and date (if available) Entity type Entity name Stage Details
1994 Browser Netspace Navigator Protocol support Netscape Communications creates HTTPS for its Netscape Navigator web browser, originally for use with the Secure Sockets Layer (SSL) protocol.
2000 May Standard RFC 2818 RFC 2818 of the Internet Engineering Task Force describes the standard for HTTPS, using HTTP over Transport Layer Security (TLS). This is considered a superior, more secure form of HTTPS than HTTPS over SSL.
2008 July 24 Website Google (Gmail) Opt-in HTTPS-only Google adds a setting in Gmail for users to always use HTTPS. Even before this, users could (since the inception of Gmail) access it securely by explicitly typing https:// in the browser. With the new setting, users who have opted in to it will be redirected from HTTP to HTTPS.[1]
2010 January 12 Website Google (Gmail) Default HTTPS-only Google switches all Gmail users to redirect to HTTPS; users can change their setings to not redirect to HTTPS. Previously, the default option for this setting was to not redirect, and users had to explicitly choose the option to redirect HTTP to HTTPS.[2]
2010 June 17 Browser extension HTTPS Everywhere The Electronic Frontier Foundation and The Tor Project, Inc launch HTTPS Everywhere, a Firefox extension, to make Firefox use HTTPS where possible.[3] The extension would evolve over the coming years. As of 2017, it is supported on Firefox, Chrome, and Opera.[4]
2010 June 2 Browser enhancement SSL False Start A Google team comprising Adam Langley, Nagendra Modadugu, and Bodo Moeller propose SSL False Start, a client-side only change to reduce one round-trip from the SSL handshake.[5][6][7] Despite tests showing that it reduces latency by 30%, the effort would be abandoned in April 2012 because of incompatibility with some servers doing early HTTPS termination.[8]
2010 October 14 Proxy/load balancer AWS Elastic Load Balancing AWS Elastic Load Balancing announces support for SSL termination. This means that websites hosted on AWS, behind AWS load balancers, can upload their certificates to the load balancer, and have the load balancer take care of the SSL certificate, so that the servers that receive the actual traffic only have to handle HTTP traffic.[9]
2011 January Website Facebook Opt-in HTTPS-only Facebook begins allowing logged-in users to opt in to have all their Facebook browsing encrypted by HTTPS.[10]
2011 January Standard OCSP stapling RFC 6066, introducing OCSP stapling, is published.[11] OCSP stapling is an alternative approach to the Online Certificate Status Protocol llows the presenter of a certificate to bear the resource cost involved in providing OCSP responses by appending ("stapling") a time-stamped OCSP response signed by the CA to the initial TLS handshake, eliminating the need for clients to contact the certificate authority. RFC 6961 would cover the case of multiple OCSP stapling.[12]
2011 March 15 Website Twitter Opt-in HTTPS-only Twitter begins allowing logged-in users to opt in to have all their Twitter browsing encrypted by HTTPS.[13]
2011 July 15 Proxy/load balancer Nginx GlobalSign, DigiCert, Comodo and NGINX Inc. announce a joint effort to add OCSP-stapling support to Nginx.[14]
2011 October 18 Website Google Search Default HTTPS-only Google makes HTTPS (using SSL) the default option for its search users who are logged in on google.com (its US site; regionally branded sites are not affected).[15][16][17] In particular, webmasters receiving traffic from Google Search will no longer be able to know the search terms that led to a specific visit.[18][19]
2012 February 13 Website Twitter Default HTTPS-only Twitter makes HTTPS the default for all logged-in users.[20][21][22]
2012 March Website Google Search Default HTTPS-only Google makes secure search the default globally for signed-in users. Previously, the change was limited to users on google.com.[23]
2012 November Website Facebook Default HTTPS-only Facebook rolls out its transition to HTTPS by default for all users, beginning with North America.[24][10]
2012 November 19 Standard RFC 6797 Default HTTPS-only The HTTP Strict Transport Security (HSTS) standard is published, after being approved on October 2.[25] The standard allows a website to set a header specifying a time period over which the client must connect to the website only via HTTPS. This protects against protocol downgrade attacks and cookie hijacking, and also avoids the extra latency involved in redirecting HTTP to HTTPS.
2013 August 21 (actual release), August 1 (announcement) Website Wikipedia Default HTTPS-only Wikimedia Foundation turns on HTTPS for all logged-in users (announcement August 1).[26][27]
2013 October 24, 25 Website Internet Archive Default HTTPS-only The Internet Archive announces that its websites archive.org (which includes the Wayback Machine at web.archive.org) and openlibrary.org are defaulted to HTTPS-only, though they will still be available over HTTP.[28][29][30]
2014 July 29 App Instagram Default HTTPS-only In response to reports about a zero-day security vulnerability, Instagram co-founder Mike Krieger reveals that the app is being moved over to HTTPS, with some parts of the app already 100% HTTPS.[31]
2014 August 6 Search ranking Google Search HTTPS boost Google announces search results will give preference to sites using HTTPS. This added ranking signal would be a "lightweight" ranking boost.[32][33]
2014 September 8 Website Reddit Opt-in HTTPS-only Reddit gives logged-in users the option of using the site purely on HTTPS.[34]
2014 November 18 Certificate authority Let's Encrypt Free HTTPS certificates Let's Encrypt, a certificate authority service that can issue HTTPS certificates for three months for free (with some limitations on the types of certificate and the conditions under which certificates can be issued), is publicly announced. The service would issue its first certificate on September 14, 2015, and leave beta on April 12, 2016.
2015 January 18 Report/Observatory HTTPSWatch State of HTTPS adoption The oldest Internet Archive snapshot of HTTPSWatch appears to be on this date. The snapshot says that it is inspired by Alex Gaynor's blog posts that were published in November and December 2014, so it is likely to be pretty close to the actual start date.[35]Cite error: Closing </ref> missing for <ref> tag
2015 February Browser Chrome HTTP/2 Chrome begins rolling out support for HTTP/2. Chrome supports HTTP/2 only over HTTPS, even though the standard allows for HTTP/2 outside of HTTPS (through the selective use of encryption).[36]
2015 March 12 Website/App Pinterest Default HTTPS-only Pinterest announces that it has moved over to HTTPS, describing the challenges it faced along the way. With the increased security in place due to HTTPS, Pinterest also introduces a paid bug bounty program for the white hat hacker community to find security flaws.[37]
2015 June 12 Website Wikipedia Default HTTPS-only The Wikimedia Foundation publishes a blog post stating that all properties (including Wikipedia) are being switched over to HTTPS; previously, HTTPS was used only for logged-in users. It seems the switch is being made immediately.[38][39][40]
2015 June Website Reddit Default HTTPS-only Reddit switches to HTTPS-only, with users being automatically redirected from HTTP to HTTPS.[41][42]
2015 October 14 Browser Chrome Mixed-content With version 46, Chrome kills off its HTTP-HTTPS "mixed-content" address bar warning. Now, HTTPS pages that load some auxiliary resources (such as images, calls to ad networks, etc.) over HTTP will say https in the address bar without the secure lock or green coloring. The change is based on the idea that mixed HTTP-HTTPS is in fact more secure than pure HTTP, and therefore should not appear scarier, and is intended to "encourage site operators to switch to HTTPS sooner rather than later."[43][44]
2016 March 15 Report/Observatory Google Transparency Report State of HTTPS adoption Google announces that it is adding a new section to its Transparency Report to track the progress of HTTPS adoption.[45][46][47]
2016 June 15 Website TechCrunch Default HTTPS-only Technology new website TechCrunch announces that it has gone HTTPS-only.[48]
2016 August 1 Website YouTube State of HTTPS adoption YouTube announces that it serves 97% of traffic over HTTPS.[49]
2016 August Website Netflix Default HTTPS-only Netflix announces that it is adding TLS encryption to all its video streams, and expects to finish the process by year-end.[50][51]
2017 January 10 Website New York Times Default HTTPS-only The New York Times announces that it has made a number of its articles default to HTTPS, including the home page, section and topic pages, and all articles published 2014 or later, and that it plans to make the rest of its site HTTPS as well.[52]
2017 January Browser Chrome Security warning With version 56, Google Chrome begins marking as "Not Secure" (in the address bar) any webpages collecting sensitive data such as passwords or credit-card information without using HTTPS.[53][54]
2017 March 30 Website Pornhub Default HTTPS-only Pornhub, the world's largest pornographic video site, switches to HTTPS-only. Sister service YouPorn is scheduled to go HTTPS-only on April 4.[55][56]
2017 May 22 Website Stack Overflow Default HTTPS-only Stack Overflow announces that it has migrated to HTTPS, after four years of work on the migration. All other Stack Exchange websites are also moved over to HTTPS.[57][58]
2017 October Browser Chrome Security warning Starting with version 62, Chrome begins marking all non-HTTPS webpages as "Not Secure" for users in incognito mode.[54]
2017 Report Research at Google State of HTTPS adoption Research at Google publishes a paper titled Measuring HTTPS adoption on the web.[59][60]

References

  1. ↑ Rideout, Ariel (July 24, 2008). "Making security easier". Google. Retrieved November 19, 2017. 
  2. ↑ Schillace, Sam (January 12, 2010). "Default https access for Gmail". Google. Retrieved November 19, 2017. 
  3. ↑ Eckersley, Peter (June 17, 2010). "Encrypt the Web with the HTTPS Everywhere Firefox Extension". Electronic Frontier Foundation. Retrieved November 19, 2017. 
  4. ↑ "HTTPS Everywhere". Retrieved November 19, 2017. 
  5. ↑ "Transport Layer Security (TLS) False Start". Internet Engineering Task Force. June 2, 2010. Retrieved November 19, 2017. 
  6. ↑ "SSL FalseStart Performance Results". Chromium blog. May 18, 2011. Retrieved November 19, 2017. 
  7. ↑ "Changing HTTPS". Imperial Violet. September 5, 2010. Retrieved November 19, 2017. 
  8. ↑ Goodin, Dan (April 12, 2012). "False Start's sad demise: Google abandons noble attempt to make SSL less painful". Retrieved November 19, 2017. 
  9. ↑ Barr, Jeff (October 14, 2010). "AWS Elastic Load Balancing: Support for SSL Termination". Amazon Web Services. Retrieved November 19, 2017. 
  10. ↑ 10.0 10.1 Constine, Josh (November 18, 2012). "Facebook Could Slow Down A Tiny Bit As It Starts Switching All Users To Secure HTTPS Connections". TechCrunch. Retrieved November 19, 2017. 
  11. ↑ "Transport Layer Security (TLS) Extensions: Extension Definitions". January 1, 2011. Retrieved November 19, 2017. 
  12. ↑ "The Transport Layer Security (TLS) Multiple Certificate Status Request Extension". June 1, 2013. Retrieved November 19, 2017. 
  13. ↑ "Making Twitter more secure: HTTPS". Twitter. March 15, 2011. Retrieved November 19, 2017. 
  14. ↑ "GlobalSign, DigiCert and Comodo Collaborate with NGINX to Improve Online Trust through Enhanced Certificate Revocation Checking, sign a Sponsorship Agreement. New version of the popular NGINX web server to support OCSP-stapling". NGINX, Inc. July 15, 2011. Retrieved November 19, 2017. 
  15. ↑ "Making search more secure". Google. October 18, 2011. Retrieved November 19, 2017. 
  16. ↑ Boulton, Clint (October 18, 2011). "Google Makes HTTPS Encryption Default for Search". eweek. Retrieved November 19, 2017. 
  17. ↑ Sullivan, Danny (October 18, 2011). "Google To Begin Encrypting Searches & Outbound Clicks By Default With SSL Search". Search Engine Land. Retrieved November 19, 2017. 
  18. ↑ "Making search more secure: Accessing search query data in Google Analytics". October 18, 2011. Retrieved November 19, 2017. 
  19. ↑ Sullivan, Danny (October 22, 2011). "Google Puts A Price On Privacy". Retrieved November 19, 2017. 
  20. ↑ "Securing your Twitter experience with HTTPS". Twitter. February 13, 2012. Retrieved November 19, 2017. 
  21. ↑ "Should All Web Traffic Be Encrypted?". Coding Horror. February 23, 2012. Retrieved November 19, 2017. 
  22. ↑ Brinkmann, Martin (February 14, 2012). "Twitter Makes HTTPS Default For Signed In Users". Retrieved November 19, 2017. 
  23. ↑ "Bringing more secure search around the globe". March 5, 2012. Retrieved November 19, 2017. 
  24. ↑ Asthana, Shireesh (November 15, 2012). "Platform Updates: Operation Developer Love". Facebook. Retrieved November 19, 2017. 
  25. ↑ "HTTP Strict Transport Security (HSTS)". November 19, 2012. Retrieved November 19, 2017. 
  26. ↑ Lane, Ryan (August 1, 2013). "The future of HTTPS on Wikimedia projects". Wikimedia Foundation. Retrieved September 25, 2016. 
  27. ↑ Eaton, Kit (August 2, 2013). "After NSA's XKeyscore, Wikipedia Switches To Secure HTTPS. The Wikimedia Foundation has announced it's pushing ahead with plans to secure its online systems due to NSA targeting.". Fast Company. Retrieved September 25, 2016. 
  28. ↑ Kahle, Brewster (October 25, 2013). "Reader Privacy at the Internet Archive". Retrieved November 19, 2017. 
  29. ↑ Streitfeld, David (October 24, 2013). "Internet Archive Will Shield Visitors". New York Times Bits Blog. Retrieved November 19, 2017. 
  30. ↑ Protalinski, Emil (October 25, 2013). "With over 3 million users per day, the Internet Archive switches to HTTPS connections by default". The Next Web. Retrieved November 19, 2017. 
  31. ↑ "Instagram to use HTTPS following discovery of gaping security hole in iOS app. Security expert warns users should not use the app until a patch is released". The Inquirer. July 29, 2014. Retrieved November 19, 2017. 
  32. ↑ "HTTPS as a ranking signal". www.google.com. Retrieved Dec 1, 2014. 
  33. ↑ Russell, Jon (August 7, 2014). "Google is now ranking websites with HTTPS higher in its search results". The Next Web. Retrieved November 19, 2017. 
  34. ↑ "Hell, It's About Time – reddit now supports full-site HTTPS". Reddit. September 8, 2014. Retrieved November 19, 2017. 
  35. ↑ "HTTPSWatch (About section)". Retrieved January 18, 2015. 
  36. ↑ "Hello HTTP/2, Goodbye SPDY". Chromium. February 9, 2015. Retrieved November 19, 2017. 
  37. ↑ Moreno, Paul (March 12, 2015). "Making Pinterest HTTPS". Pinterest Engineering via Medium. Retrieved November 20, 2017. 
  38. ↑ Welinder, Yana; Baranetsky, Victoria; Black, Brandon (June 12, 2015). "Securing access to Wikimedia sites with HTTPS". Wikimedia Foundation. Retrieved September 25, 2016. 
  39. ↑ Thomas, Karl (June 15, 2015). "Wikipedia switches to HTTPS by default". WeLiveSecurity. Retrieved September 25, 2016. 
  40. ↑ Farivar, Cyrus (June 15, 2015). "Wikipedia goes all-HTTPS, starting immediately. "We believe that the time for HTTPS by default is now."". ArsTechnica. Retrieved September 25, 2016. 
  41. ↑ Lorenzo Franceschi-Bicchierai (June 17, 2015). "Reddit Switches to Encryption By Default. The internet giant will switch to HTTPS by default by the end of the month.". Vice. Retrieved November 19, 2017. 
  42. ↑ "reddit will soon only be available over HTTPS (self.redditdev)". Reddit. June 16, 2015. Retrieved November 19, 2017. 
  43. ↑ Anthony, Sebastian (October 14, 2015). "Chrome finally kills off the HTTP-HTTPS "mixed content" warning. Slightly alarming and not wholly useful yellow triangle is being retired.". Retrieved November 20, 2017. 
  44. ↑ Whittaker, Zack (October 14, 2015). "Chrome 46 loosens up on HTTPS 'mixed content' warnings. The browser -- known for being a bit overkill -- finally drops its yellow-warning attached to pages with both secure and non-secure content.". Retrieved November 19, 2017. 
  45. ↑ "Securing the web, together". Google Security Blog. March 15, 2016. Retrieved November 19, 2017. 
  46. ↑ Schwartz, Barry (March 16, 2016). "Google Report On HTTPS Adoption Within Google & The Top Web Sites". Search Engine Roundtable. Retrieved November 19, 2017. 
  47. ↑ "Google's Transparency Report to Include HTTPS Adoption Rates". Search Engine Journal. March 25, 2016. Retrieved November 19, 2017. 
  48. ↑ Wilke, Nicole (June 15, 2016). "TechCrunch has gone HTTPS". Retrieved November 19, 2017. 
  49. ↑ "YouTube's road to HTTPS". YouTube. August 1, 2016. Retrieved November 19, 2017. 
  50. ↑ "Protecting Netflix Viewing Privacy at Scale". Netflix on Medium. August 8, 2016. Retrieved November 19, 2017. 
  51. ↑ "Netflix explains how and why it's switching to HTTPS streaming. Adding encryption increases privacy for viewers -- and for Netflix.". August 9, 2016. Retrieved November 19, 2017. 
  52. ↑ Konigsburg, Eitan; Wan, Vinessa (January 1, 2010). "HTTPS on NYTimes.com". New York Times Open blog. Retrieved November 19, 2017. 
  53. ↑ Murray, Brock (January 21, 2017). "Google Is Requiring HTTPS for Secure Data in Chrome". Retrieved November 19, 2017. 
  54. ↑ 54.0 54.1 Tung, Liam (April 28, 2017). "Google tightens noose on HTTP: Chrome to stick 'Not secure' on pages with search fields. In October, Google will begin phase two of its plan to label all HTTP pages as non-secure.". ZDNet. Retrieved November 15, 2017. 
  55. ↑ Barrett, Brian (March 30, 2017). "THE WORLD'S BIGGEST PORN SITE GOES ALL-IN ON ENCRYPTION". Wired. Retrieved November 9, 2017. 
  56. ↑ Garun, Natt (March 30, 2017). "Pornhub now turns on encryption by default". The Verge. Retrieved November 19, 2017. 
  57. ↑ Craver, Nick (May 22, 2017). "HTTPS on Stack Overflow: The End of a Long Road". Retrieved November 19, 2017. 
  58. ↑ Taylor, Anita (May 22, 2017). "How Stack Overflow Flipped the Switch on HTTPS". Stack Overflow. Retrieved November 19, 2017. 
  59. ↑ Feit, Adrienne Porter; Barnes, Richard; King, April; Palmer, Chris; Bentzel, Chris; Tabriz, Parisa. "Measuring HTTPS adoption on the web". Retrieved November 20, 2017. 
  60. ↑ Feit, Adrienne Porter; Barnes, Richard; King, April; Palmer, Chris; Bentzel, Chris; Tabriz, Parisa. "Measuring HTTPS adoption on the web" (PDF). Retrieved November 20, 2017. 
Retrieved from "http://timelines.issarice.com/index.php?title=Timeline_of_HTTPS_adoption&oldid=18579"