Timeline of HTTPS adoption

From Timelines
Revision as of 09:19, 13 April 2019 by Vipul (talk | contribs) (→‎Full timeline)
Jump to: navigation, search

This timeline describes the gradual increase in websites and clients using HTTPS.

Big picture

Entity types and qualitative details

HTTPS is an end-to-end protocol. Therefore, it need only be supported by the browser (on the client side) and the server (it could be terminated at the load balancer or proxy or dealt with directly by the process serving the content).

Other intermediaries, like Internet Service Providers (ISPs), routers, networking services, etc. do not need to be upgraded to support HTTPS. The main effects on them from the transition to HTTPS are: (a) the ability of their packet analyzers to sniff traffic reduces, and (b) the volume of traffic they deal with goes up a little bit.

Entity type Broad classification Top entity names Typical stages Details
Standard -- This includes standards around client-server communication for HTTPS. Most of these are published by the Internet Engineering Task Force (IETF).
Browser Client-side Chrome, Firefox, Netscape Navigator Security warning Beyond initial HTTPS support (which was present in most browsers from the get-go), the main browser evolution has centered around the way security warnings are presented around HTTP versus HTTPS, mixed content, and problems with HTTPS certificates.
Browser extension Client-side Firesheep, HTTPS Everywhere Vulnerability exploit, security improvement Browser extensions have played some role in identifying and protecting against vulnerabilities of unencrypted (plain HTTP) connections.
Website Server-side Lots of websites HTTPS available, opt-in HTTPS-only, default HTTPS-only, HTTPS-only Websites may start by making HTTPS available, so that people who type https:// in the browser will get the HTTPS website. They may then transition to allowing logged-in users to opt-in to HTTPS-only, so that they will see internal links in HTTPS only and will automatically be redirected from HTTP to HTTPS. The next step is default HTTPS-only, which means that except for users who explicitly opt out, everybody is redirected to HTTPS (this could come in two stages: first rolled out to logged-in users only, then to all). Finally, the HTTPS-only stage is when access over plain HTTP is no longer supported.
Webmail Server-side Gmail, Hotmail, Yahoo! Mail HTTPS available, opt-in HTTPS-only, default HTTPS-only, HTTPS-only Similar to the stages for website. However, webmail is generally more sensitive, so the importance of switching to HTTPS is higher, and webmail services switched to HTTPS before websites.
Search engine Server-side Google Search, Bing, Yahoo! Search HTTPS available, opt-in HTTPS-only, default HTTPS-only, HTTPS-only Similar to the stages for website. Search engine data is intermediate in sensitivity between websites and webmail, and in terms of the chronological evolution also moved to HTTPS somewhere in between.
Proxy/load balancer Server-side Amazon Web Services Early SSL termination Load balancers can manage the SSL/TLS certificates and forward only plain HTTP requests to the servers that have to actually respond to the request.
CDN Server-side Amazon CloudFront Custom SSL Content delivery networks are used to serve static content at low latency and low cost around the world. CDNs have evolved to allow customers to upload their own SSL certificates for content.
Ecosystem Server-side Advertising Various backend ecosystems that power the technology and monetization of the web, such as advertising, need to support HTTPS in order to complete the transition to HTTPS.

Time period grouping

Time period Qualitative summary of developments
1994–2007 During this period, many of the standards related to HTTPS (HTTP over SSL, HTTP over TLS, SNI) are published as RFCs by the Internet Engineering Task Force. Certificate authorities (CAs) come into being and the CA/Browser Forum is created. A few sites, generally those related to e-commerce, start using HTTPS.
2008–2012 The move to HTTPS begins, with Google taking the lead, and Twitter and Facebook following. Webmail moves first, then search for logged-in users. The general playbook is: HTTPS available, opt-in HTTPS-only, then default HTTPS-only.
2013–2014 The move to HTTPS continues, with laggers in webmail and search catching up on encryption, and Google beginning encryption even for non-logged-in users. Toward the end of this period, Google begins aggressively pushing for the whole web to go HTTPS, first by stating that HTTPS will be a search ranking signal, then by declaring that Chrome eventually intends to mark all plain HTTP sites as not secure.
2015–2017 This is the period when the move to HTTPS intensifies among a number of ordinary websites. Wikipedia, Wordpress.com (?), Reddit, Imgur, and some major newspapers and magazines like the New York Times, TechCrunch, and Wired go HTTPS. Chrome begins the process of marking plain HTTP sites as Not Secure. Let's Encrypt makes it easy and free for people to move to HTTPS. Google and others set up systematic tracking of the proportion of HTTPS usage, and the period ends with a significant increase in HTTPS use.

Full timeline

Year Month and date (if available) Entity type Entity name Stage Details
1994 Standard SSL v1.0 Protocol Netscape Communications creates HTTPS for its Netscape Navigator web browser, originally for use with the Secure Sockets Layer (SSL) protocol (SSL version 1.0). Due to security issues, this is never officially published. See w:Transport Layer Security#SSL_1.0.2C_2.0_and_3.0.
1995 February Standard SSL v2.0 Protocol SSL v2.0 is released. It has a number of security flaws. See w:Transport Layer Security#SSL_1.0.2C_2.0_and_3.0.
1995 July Server hosting Netscape Commercial offering Fortune reports that Netscape charges $1,495 for a server and $5,000 for a server with secure communication (i.e., serving traffic over HTTPS).[1][2]
1995 September 19 Bugfix Vulnerability exploit Two graduate students at the University of California, Berkeley discover a security vulnerability with Netscape Navigator, that also affects HTTPS sites and risks credit card transactions being eavesdropped on.[3][4][2]
1996 Standard SSL v3.0 Protocol SSL v3.0 is released and its specification is drafted. IETF would publish this draft as a historical document in 2011.[5]
1999 January Standard TLS 1.0 Protocol Version 1.0 of the Transport Layer Security (TLS) protocol is published as RFC 2246. TLS would replace SSL as the protocol used for HTTPS.[6]
2000 May Standard HTTP over TLS Protocol RFC 2818 of the Internet Engineering Task Force (IETF) describes the standard for HTTPS, using HTTP over Transport Layer Security (TLS).[7]
2003 June Standard SNI Protocol RFS 3546 of the IETF describes a number of augmentations to TLS, including Server Name Indication (SNI).[8]
2004 April 1 Webmail Google (Gmail) HTTPS availability Gmail, Google's web-based email service, launches. The service is available over HTTPS right from the time of launch.[2]
2004 April 14 Bugfix Vulnerability exploit Microsoft issues a fix for a bug in its SSL library that allows remote attackers to gain control of unpatched Windows 2000 and Windows NT4 servers offering encrypted services over the internet.[9]
2005 April 20 A blog post by Microsoft argues that using non-HTTPS login pages is insecure, even if the form submission is to a HTTPS page.[10][2]
2005 The CA/Browser Forum is founded. It is a voluntary consortium of certification authorities, vendors of Internet browser software, operating systems, and other PKI-enabled applications that promulgates industry guidelines governing the issuance and management of X.509 v.3 digital certificates that chain to a trust anchor embedded in such applications.
2006 April Standard TLS 1.1 Protocol RFC 4346 defines TLS 1.1, the next version of TLS after TLS 1.0.[11]
2008 July 24 Webmail Google (Gmail) Opt-in HTTPS-only Google adds a setting in Gmail for users to always use HTTPS. Even before this, users could (since the inception of Gmail) access it securely by explicitly typing https:// in the browser. With the new setting, users who have opted in to it will be redirected from HTTP to HTTPS.[12][2]
2008 August Standard TLS 1.2 Protocol RFC 5246 defines TLS 1.2, the next version of TLS after TLS 1.1.[13]
2010 January 12 Webmail Google (Gmail) Default HTTPS-only Google switches all Gmail users to redirect to HTTPS; users can change their setings to not redirect to HTTPS. Previously, the default option for this setting was to not redirect, and users had to explicitly choose the option to redirect HTTP to HTTPS.[14][2]
2010 May 21 Search engine Google Search HTTPS availability Google makes search available on SSL at https://www.google.com. However, on June 25, they announced that they are moving encrypted search to https://encrypted.google.com because of challenges reported by school districts.[15][2]
2010 June 17 Browser extension HTTPS Everywhere Security improvement The Electronic Frontier Foundation and The Tor Project, Inc launch HTTPS Everywhere, a Firefox extension, to make Firefox use HTTPS where possible.[16] The extension would evolve over the coming years. As of 2017, it is supported on Firefox, Chrome, and Opera.[17]
2010 June 2 Browser enhancement SSL False Start A Google team comprising Adam Langley, Nagendra Modadugu, and Bodo Moeller propose SSL False Start, a client-side only change to reduce one round-trip from the SSL handshake.[18][19][20] Despite tests showing that it reduces latency by 30%, the effort would be abandoned in April 2012 because of incompatibility with some servers doing early HTTPS termination.[21]
2010 October Browser extension Firesheep Vulnerability exploit Firesheep, a Firefox browser extension that uses a packet analyzer to intercept unencrypted session cookies over Wi-Fi networks, is released. The extension highlights the need for greater security, both in terms of websites moving to HTTPS (end-to-end security) and improving security of Wi-Fi.
2010 October 14 Proxy/load balancer AWS Elastic Load Balancing Early SSL termination AWS Elastic Load Balancing announces support for SSL termination. This means that websites hosted on AWS, behind AWS load balancers, can upload their certificates to the load balancer, and have the load balancer take care of the SSL certificate, so that the servers that receive the actual traffic only have to handle HTTP traffic.[22]
2010 November 3 Website GitHub Default HTTPS-only In response to the release of Firesheep, GitHub moves to HTTPS for all users; previously full-session SSL was only available to paying users.[23]
2010 November 9 Webmail Hotmail (Microsoft) Opt-in HTTPS-only Microsoft lets users of its web-based email service, Hotmail, set HTTPS by default.[24][25]
2011 January Website Facebook Opt-in HTTPS-only Facebook begins allowing logged-in users to opt in to have all their Facebook browsing encrypted by HTTPS.[26]
2011 January Standard OCSP stapling RFC 6066, introducing OCSP stapling, is published.[27] OCSP stapling is an alternative approach to the Online Certificate Status Protocol that allows the presenter of a certificate to bear the resource cost involved in providing OCSP responses by appending ("stapling") a time-stamped OCSP response signed by the CA to the initial TLS handshake, eliminating the need for clients to contact the certificate authority. RFC 6961 would cover the case of multiple OCSP stapling.[28]
2011 March 15 Website Twitter Opt-in HTTPS-only Twitter begins allowing logged-in users to opt in to have all their Twitter browsing encrypted by HTTPS.[29]
2011 July 15 Proxy/load balancer Nginx GlobalSign, DigiCert, Comodo and NGINX Inc. announce a joint effort to add OCSP-stapling support to Nginx.[30]
2011 October 18 Search engine Google Search Default HTTPS-only Google makes HTTPS (using SSL) the default option for its search users who are logged in on google.com (its US site; regionally branded sites are not affected).[31][32][33] In particular, webmasters receiving traffic from Google Search will no longer be able to know the search terms that led to a specific visit.[34][35]
2012 February 13 Website Twitter Default HTTPS-only Twitter makes HTTPS the default for all logged-in users.[36][37][38]
2012 March Search engine Google Search Default HTTPS-only Google makes secure search the default globally for signed-in users. Previously, the change was limited to users on google.com.[39]
2012 July 31 Webmail Outlook (formerly Hotmail) (Microsoft) Default HTTPS-only With the rebranding of Hotmail as Outlook.com, Microsoft moves to default HTTPS-only for all usersof the web-based email service.[25]
2012 October 9 Website Quora Opt-in HTTPS-only On or before this date, question-and-answer website Quora allows logged-in users to opt in to HTTPS-only.[40]
2012 November Website Facebook Default HTTPS-only Facebook rolls out its transition to HTTPS by default for all users, beginning with North America.[41][26] The move is reported to be completed on August 1, 2013.[42]
2012 November 19 Standard RFC 6797 Default HTTPS-only The HTTP Strict Transport Security (HSTS) standard is published, after being approved on October 2.[43] The standard allows a website to set a header specifying a time period over which the client must connect to the website only via HTTPS. This protects against protocol downgrade attacks and cookie hijacking, and also avoids the extra latency involved in redirecting HTTP to HTTPS.
2013 February The Certificate Authority Security Council is founded by the seven largest certificate authorities: Comodo, Symantec, Trend Micro, DigiCert, Entrust, Entrust, GlobalSign, and GoDaddy.
2013 August 21 (actual release), August 1 (announcement) Website Wikipedia Default HTTPS-only Wikimedia Foundation turns on HTTPS for all logged-in users (announcement August 1).[44][45]
2013 September Search engine Google Search Default HTTPS-only Google Search moves all searches, even those by users who are not logged in, to HTTPS. The only exception is ad clicks. The change is believed to be a response to concerns about privacy triggered by relevations about PRISM, a United States federal government surveillance program.[46]
2013 September 26 Website Imgur HTTPS available Image-hosting service Imgur makes HTTPS available sitewide.[47]
2013 October 14 Webmail Yahoo! Default HTTPS-only Yahoo! Mail moves to a default of HTTPS-only.[25]
2013 October 24, 25 Website Internet Archive Default HTTPS-only The Internet Archive announces that its websites archive.org (which includes the Wayback Machine at web.archive.org) and openlibrary.org are defaulted to HTTPS-only, though they will still be available over HTTP.[48][49][50]
2014 January 22 Search engine Yahoo! Default HTTPS-only Yahoo! Search makes HTTPS-only the default. The change is initially rolled out on yahoo.com, but is expected to be rolled out to other regions as well.[51]
2014 January Website YouTube Some move to HTTPS YouTube begins sending traffic over HTTPS, significantly increasing the volume of traffic sent on the web via HTTPS. By September 2014, 50% of YouTube traffic would be sent via HTTPS.[52]
2014 March 5 CDN Amazon CloudFront SNI custom SSL, HTTPS redirection Amazon CloudFront announces support for customers to use their own SSL certificates through the implementation of Server Name Indication, as well as HTTP to HTTPS redirection (via 301 redirect).
2014 July 29 App Instagram Default HTTPS-only In response to reports about a zero-day security vulnerability, Instagram co-founder Mike Krieger reveals that the app is being moved over to HTTPS, with some parts of the app already 100% HTTPS.[53]
2014 August 6 Search ranking Google Search HTTPS boost Google announces search results will give preference to sites using HTTPS. This added ranking signal would be a "lightweight" ranking boost.[54][55]
2014 September 8 Website Reddit Opt-in HTTPS-only Reddit gives logged-in users the option of using the site purely on HTTPS.[56]
2014 November 18 Certificate authority Let's Encrypt Free HTTPS certificates Let's Encrypt, a certificate authority service that can issue HTTPS certificates for three months for free (with some limitations on the types of certificate and the conditions under which certificates can be issued), is publicly announced. The service would issue its first certificate on September 14, 2015, and leave beta on April 12, 2016.
2014 December 18 Browser Chrome Security warning Google Chrome announces its intention of adding warnings for users visiting non-HTTPS websites.[57] More details are announced in late January 2015.[58]
2015 January 18 Report/Observatory HTTPSWatch State of HTTPS adoption The oldest Internet Archive snapshot of HTTPSWatch appears to be on this date. The snapshot says that it is inspired by Alex Gaynor's blog posts that were published in November and December 2014, so it is likely to be pretty close to the actual start date.[59][60][61]
2015 February Browser Chrome HTTP/2 Chrome begins rolling out support for HTTP/2. Chrome supports HTTP/2 only over HTTPS, even though the standard allows for HTTP/2 outside of HTTPS (through the selective use of encryption).[62]
2015 March 12 Website/App Pinterest Default HTTPS-only Pinterest announces that it has moved over to HTTPS, describing the challenges it faced along the way. With the increased security in place due to HTTPS, Pinterest also introduces a paid bug bounty program for the white hat hacker community to find security flaws.[63]
2015 March 25 Ecosystem Advertising Exhortation Writing for the Interactive Advertising Bureau (IAB), Brendan Riordan-Butterworth calls for the advertising ecosystem to move to HTTPS.[64]
2015 April 13 Browser Firefox Security warning Mozilla announces plans to deprecate plain HTTP in their browser, Firefox.[65][66]
2015 June 8 Website United States government Default HTTPS-only The White House Office of Management and Budget issues the HTTPS-Only Standard directive requiring that all United States federal government websites provide service only via HTTPS, with a deadline of end of 2016.[67][68][69]
2015 June 12 Website Wikipedia Default HTTPS-only The Wikimedia Foundation publishes a blog post stating that all properties (including Wikipedia) are being switched over to HTTPS; previously, HTTPS was used only for logged-in users. It seems the switch is being made immediately.[70][71][72]
2015 June Search engine Bing Default HTTPS-only Microsoft announces that it will make HTTPS-only the default on Bing, its search engine.[73][74]
2015 June Website Reddit Default HTTPS-only Reddit switches to HTTPS-only, with users being automatically redirected from HTTP to HTTPS.[75][76]
2015 June 30 (deadline), April 17 (announcement) Ad network Google AdWords HTTPS availability As part of Google's HTTPS Everywhere initiative, Google AdWords announces, on April 17, some of it progress already made on moving ads to HTTPS (specifically, moving YouTube ads to HTTPS). Also, it is stated that the vast majority of mobile, video, and desktop display ads served to the Google Display Network, AdMob and DoubleClick publishers will be encrypted by June 30, and advertisers using any of the buying platforms, including AdWords and DoubleClick, will be able to serve HTTPS-encrypted display ads to all HTTPS-enabled inventory.[77]
2015 October 14 Browser Chrome Mixed-content With version 46, Chrome kills off its HTTP-HTTPS "mixed-content" address bar warning. Now, HTTPS pages that load some auxiliary resources (such as images, calls to ad networks, etc.) over HTTP will say https in the address bar without the secure lock or green coloring. The change is based on the idea that mixed HTTP-HTTPS is in fact more secure than pure HTTP, and therefore should not appear scarier, and is intended to "encourage site operators to switch to HTTPS sooner rather than later."[78][79]
2016 February Website Wikipedia Referrer policy The Wikimedia Foundation rolls out an update to the HTTPS meta referrer policy, that reveals the Origin rather than the full path of the referring domain. This means that websites that receive traffic from Wikipedia can once again calculate how much traffic they are receiving from Wikipedia, an ability that was lost in the switch to HTTPS. However, unlike the pre-HTTPS situation, full referral paths are not accessible, so websites cannot know what Wikipedia pages are sending traffic to them. For more, see Research:Wikimedia referrer policy.[80]
2016 March 15 Report/Observatory Google Transparency Report State of HTTPS adoption Google announces that it is adding a new section to its Transparency Report to track the progress of HTTPS adoption.[81][82][83]
2016 March 23 Google provides a list of certificate authorities it does not trust.[84]
2016 April 28 Website WIRED Default HTTPS-only WIRED announces that its website has gone HTTPS-only. The article announcing the transition explains the challenges involved in making sure every digital asset loaded on every page is HTTPS.[85]
2016 June 14 App store service Apple Default HTTPS-only At the Apple Worldwide Developers Conference, Apple announces that it will require all iOS apps to use HTTPS connections by the end of 2016.[86]
2016 June 15 Website TechCrunch Default HTTPS-only Technology new website TechCrunch announces that it has gone HTTPS-only.[87]
2016 August 1 Website YouTube State of HTTPS adoption YouTube announces that it serves 97% of traffic over HTTPS.[88]
2016 August Website Netflix Default HTTPS-only Netflix announces that it is adding TLS encryption to all its video streams, and expects to finish the process by year-end.[89][90]
2016 August 25 Report/Observatory Mozilla State of HTTPS adoption Mozilla, the organization that manages the Firefox browser, creates the Mozilla Observatory to track the web and its security. Among other things, this tracks the state of HTTPS adoption.[91][92]
2017 January 10 Website New York Times Default HTTPS-only The New York Times announces that it has made a number of its articles default to HTTPS, including the home page, section and topic pages, and all articles published 2014 or later, and that it plans to make the rest of its site HTTPS as well.[93]
2017 January 21 Guideline American Library Association HTTPS use guideline The American Library Association publishes a library privacy checklist approved by its intellectual freedom committee. The checklist mentions HTTPS twice. In priority 1 actions, it includes an action "Ensure all existing security certificates for HTTPS/SSL are valid and create a procedure for revalidating them annually." In priority 2 actions, it includes an action "Utilize HTTPS wherever possible." (Ironically, even as of April 2019, the American Library Association website does not properly support HTTPS, with the HTTPS site redirecting to the HTTP site).[94]
2017 January Browser Chrome Security warning With version 56, Google Chrome begins marking as "Not Secure" (in the address bar) any webpages collecting sensitive data such as passwords or credit-card information without using HTTPS.[95][96]
2017 January 4 Website National Public Radio Default HTTPS-only National Public Radio announces that it has transitioned most of its webpages and streaming content to HTTPS, and is making sure that any new content is served through HTTPS.[97]
2017 March 30 Website Pornhub Default HTTPS-only Pornhub, the world's largest pornographic video site, switches to HTTPS-only. Sister service YouPorn is scheduled to go HTTPS-only on April 4.[98][99]
2017 May 22 Website Stack Overflow Default HTTPS-only Stack Overflow announces that it has migrated to HTTPS, after four years of work on the migration. All other Stack Exchange websites are also moved over to HTTPS.[100][101]
2017 May through August 16 Website Springer-Verlag Default HTTPS-only Publisher Springer transitions its websites to HTTPS, with HTTP redirecting to HTTPS.[102][103]
2017 September 13 Website Imgur Default HTTPS-only Image-hosting service Imgur defaults to HTTPS-only for all users (both logged-in and others).[104]
2017 October Browser Chrome Security warning Starting with version 62, Chrome begins marking all non-HTTPS webpages as "Not Secure" for users in incognito mode.[96]
2017 Report Research at Google State of HTTPS adoption Research at Google publishes a paper titled Measuring HTTPS adoption on the web.[105][106]
2017 Standard TLS 1.3 Protocol The standard for TLS 1.3 is under discussion, but not finalized. Browsers support it for a while as the default but then stop due to issues. See w:Transport Layer Security#TLS_1.3_.28draft.29 for more. As of the end of 2017, TLS 1.3 is still not ready.[107]
2018 February 27 Certificate authority Let's Encrypt Wildcard support Let's Encrypt plans to make wildcard support fully available on this date, after launching a public test API endpoint for the ACME v2 protocol and wildcard support on January 4, 2018.[108]
2018 April 14 Website IMDb Default HTTPS-only Judging from homepage captures on the Internet Archive's Wayback Machine, this is the date that the IMDb transitions from HTTP to default HTTPS-only. See captures for April 13[109] and April 14.[110] There does not appear to be any official announcement of the transition, but a Quora question with answers as late as February 2018 confirms that people noticed that the site was still using plain HTTP till February 2018.[111]
2018 July (planned date), February 8 (announcement) Browser Chrome Security warning On February 8, Google Chrome announces that starting with Chrome 68, which will be released in July, all plain HTTP sites will be marked as not secure.[112][113][114] The release happens as scheduled. Forbes publishes an article naming a few sites that still do not default to HTTPS as of the time of this change to Chrome. The sites include Fox News, the Los Angeles Times, Chicago Tribune, Time, ESPN, NFL Network, NBA, and more. Some of these sites, such as Time and ESPN, still do not default to HTTPS as of April 2019.[115]
2019 January to February; with some early test efforts in October 2018, and some wrap-up work as late as April 11 Website Wikia / Fandom Default HTTPS-only Fandom Inc., the company previously known as Wikia, moves the bulk of their community wikis from HTTP to HTTPS, while also changing the domain from wikia.com to fandom.com (to be more consistent with the company's new name and branding). Some domains that do not fit with the Fandom brand are moved to wikia.org instead; these are also migrated to HTTPS.[116]

See also

References

  1. ↑ Sprout, Alison (July 1, 1995). "The rise of Netscape". Retrieved March 11, 2018. 
  2. ↑ 2.0 2.1 2.2 2.3 2.4 2.5 2.6 Kaufman, Jeff (March 8, 2018). "History of HTTPS Usage". Retrieved March 11, 2018. 
  3. ↑ "Netscape: Internet security flaw can be fixed.". September 19, 1995. Retrieved March 11, 2018. 
  4. ↑ Markoff, John (October 16, 1995). "The New Watchdogs of Digital Commerce". New York Times. Retrieved March 11, 2018. 
  5. ↑ "The Secure Sockets Layer (SSL) Protocol Version 3.0". Internet Engineering Task Force. August 1, 2011. Retrieved November 23, 2017. 
  6. ↑ "The TLS Protocol Version 1.0". Internet Engineering Task Force. January 1, 1999. Retrieved November 23, 2017. 
  7. ↑ "HTTP Over TLS". Internet Engineering Task Force. May 1, 2000. Retrieved November 23, 2017. 
  8. ↑ "Transport Layer Security (TLS) Extensions". Internet Engineering Task Force. June 1, 2003. Retrieved November 20, 2017. 
  9. ↑ "Microsoft SSL Vulnerability gives attackers opportunity to gain control of leading banking sites". Netcraft. April 14, 2004. Retrieved March 11, 2018. 
  10. ↑ "TLS and SSL in the real world". April 20, 2005. Retrieved March 11, 2018. 
  11. ↑ "The Transport Layer Security (TLS) Protocol Version 1.1". Internet Engineering Task Force. April 1, 2006. Retrieved November 23, 2017. 
  12. ↑ Rideout, Ariel (July 24, 2008). "Making security easier". Google. Retrieved November 19, 2017. 
  13. ↑ "The Transport Layer Security (TLS) Protocol Version 1.2". Internet Engineering Task Force. August 1, 2008. Retrieved November 23, 2017. 
  14. ↑ Schillace, Sam (January 12, 2010). "Default https access for Gmail". Google. Retrieved November 19, 2017. 
  15. ↑ Roseman, Evan (May 21, 2010). "Search more securely with encrypted Google web search". Google Official Blog. Retrieved March 11, 2018. 
  16. ↑ Eckersley, Peter (June 17, 2010). "Encrypt the Web with the HTTPS Everywhere Firefox Extension". Electronic Frontier Foundation. Retrieved November 19, 2017. 
  17. ↑ "HTTPS Everywhere". Retrieved November 19, 2017. 
  18. ↑ "Transport Layer Security (TLS) False Start". Internet Engineering Task Force. June 2, 2010. Retrieved November 19, 2017. 
  19. ↑ "SSL FalseStart Performance Results". Chromium blog. May 18, 2011. Retrieved November 19, 2017. 
  20. ↑ "Changing HTTPS". Imperial Violet. September 5, 2010. Retrieved November 19, 2017. 
  21. ↑ Goodin, Dan (April 12, 2012). "False Start's sad demise: Google abandons noble attempt to make SSL less painful". Retrieved November 19, 2017. 
  22. ↑ Barr, Jeff (October 14, 2010). "AWS Elastic Load Balancing: Support for SSL Termination". Amazon Web Services. Retrieved November 19, 2017. 
  23. ↑ "GitHub moves to SSL, but remains Firesheepable". Netcraft. November 3, 2010. Retrieved November 20, 2017. 
  24. ↑ Mills, Elinor (November 9, 2010). "Microsoft lets Hotmail users set encryption by default. Microsoft adds full-session encryption option to HOtmail and SSL for SkyDrive, Photos, Docs, and Devices pages.". CNet. Retrieved November 20, 2017. 
  25. ↑ 25.0 25.1 25.2 Peterson, Andrea; Gellman, Barton; Soltani, Ashkan (October 14, 2013). "Yahoo to make SSL encryption the default for Webmail users. Finally.". Retrieved November 20, 2017. 
  26. ↑ 26.0 26.1 Constine, Josh (November 18, 2012). "Facebook Could Slow Down A Tiny Bit As It Starts Switching All Users To Secure HTTPS Connections". TechCrunch. Retrieved November 19, 2017. 
  27. ↑ "Transport Layer Security (TLS) Extensions: Extension Definitions". January 1, 2011. Retrieved November 19, 2017. 
  28. ↑ "The Transport Layer Security (TLS) Multiple Certificate Status Request Extension". June 1, 2013. Retrieved November 19, 2017. 
  29. ↑ "Making Twitter more secure: HTTPS". Twitter. March 15, 2011. Retrieved November 19, 2017. 
  30. ↑ "GlobalSign, DigiCert and Comodo Collaborate with NGINX to Improve Online Trust through Enhanced Certificate Revocation Checking, sign a Sponsorship Agreement. New version of the popular NGINX web server to support OCSP-stapling". NGINX, Inc. July 15, 2011. Retrieved November 19, 2017. 
  31. ↑ "Making search more secure". Google. October 18, 2011. Retrieved November 19, 2017. 
  32. ↑ Boulton, Clint (October 18, 2011). "Google Makes HTTPS Encryption Default for Search". eweek. Retrieved November 19, 2017. 
  33. ↑ Sullivan, Danny (October 18, 2011). "Google To Begin Encrypting Searches & Outbound Clicks By Default With SSL Search". Search Engine Land. Retrieved November 19, 2017. 
  34. ↑ "Making search more secure: Accessing search query data in Google Analytics". October 18, 2011. Retrieved November 19, 2017. 
  35. ↑ Sullivan, Danny (October 22, 2011). "Google Puts A Price On Privacy". Retrieved November 19, 2017. 
  36. ↑ "Securing your Twitter experience with HTTPS". Twitter. February 13, 2012. Retrieved November 19, 2017. 
  37. ↑ "Should All Web Traffic Be Encrypted?". Coding Horror. February 23, 2012. Retrieved November 19, 2017. 
  38. ↑ Brinkmann, Martin (February 14, 2012). "Twitter Makes HTTPS Default For Signed In Users". Retrieved November 19, 2017. 
  39. ↑ "Bringing more secure search around the globe". March 5, 2012. Retrieved November 19, 2017. 
  40. ↑ Cook, Tom (October 9, 2012). "Does Quora support HTTPS? Tom Cook's answer log". Retrieved November 20, 2017. 
  41. ↑ Asthana, Shireesh (November 15, 2012). "Platform Updates: Operation Developer Love". Facebook. Retrieved November 19, 2017. 
  42. ↑ "Secure browsing by default". August 1, 2013. Retrieved November 20, 2017. 
  43. ↑ "HTTP Strict Transport Security (HSTS)". November 19, 2012. Retrieved November 19, 2017. 
  44. ↑ Lane, Ryan (August 1, 2013). "The future of HTTPS on Wikimedia projects". Wikimedia Foundation. Retrieved September 25, 2016. 
  45. ↑ Eaton, Kit (August 2, 2013). "After NSA's XKeyscore, Wikipedia Switches To Secure HTTPS. The Wikimedia Foundation has announced it's pushing ahead with plans to secure its online systems due to NSA targeting.". Fast Company. Retrieved September 25, 2016. 
  46. ↑ Sullivan, Danny (September 23, 2013). "Post-PRISM, Google Confirms Quietly Moving To Make All Searches Secure, Except For Ad Clicks". Retrieved November 20, 2017. 
  47. ↑ "100 MILLION UNIQUES, HIGHER UPLOAD LIMITS, AND HTTPS SUPPORT". September 26, 2013. Retrieved November 20, 2017. 
  48. ↑ Kahle, Brewster (October 25, 2013). "Reader Privacy at the Internet Archive". Retrieved November 19, 2017. 
  49. ↑ Streitfeld, David (October 24, 2013). "Internet Archive Will Shield Visitors". New York Times Bits Blog. Retrieved November 19, 2017. 
  50. ↑ Protalinski, Emil (October 25, 2013). "With over 3 million users per day, the Internet Archive switches to HTTPS connections by default". The Next Web. Retrieved November 19, 2017. 
  51. ↑ Sullivan, Danny (January 22, 2014). "Yahoo Makes Secure Search The Default". MarketingLand. Retrieved November 20, 2017. 
  52. ↑ Naylor, David; Leontiadis, Alessandro; Grunenberger, Yan; Mellia, Marco; Munafo, Maurizio; Papagiannaki, Konstantina; Steenkiste, Peter. "The Cost of the "S" in HTTPS" (PDF).  |first3= missing |last3= in Authors list (help)
  53. ↑ "Instagram to use HTTPS following discovery of gaping security hole in iOS app. Security expert warns users should not use the app until a patch is released". The Inquirer. July 29, 2014. Retrieved November 19, 2017. 
  54. ↑ "HTTPS as a ranking signal". www.google.com. Retrieved Dec 1, 2014. 
  55. ↑ Russell, Jon (August 7, 2014). "Google is now ranking websites with HTTPS higher in its search results". The Next Web. Retrieved November 19, 2017. 
  56. ↑ "Hell, It's About Time – reddit now supports full-site HTTPS". Reddit. September 8, 2014. Retrieved November 19, 2017. 
  57. ↑ Slegg, Jennifer (December 18, 2014). "Google Chrome Wants to Warn Users Before Visiting All Non-HTTPS Sites". The SEM Post. Retrieved November 20, 2017. 
  58. ↑ Slegg, Jennifer (January 28, 2015). "First Look at How Google Chrome Plans to Alert Users to Non-HTTPS Websites". Retrieved November 20, 2017. 
  59. ↑ "HTTPSWatch (About section)". Retrieved January 18, 2015. 
  60. ↑ Gaynor, Alex (November 12, 2015). "The State of the News and TLS". Retrieved November 20, 2015. 
  61. ↑ Gaynor, Alex (December 30, 2014). "The State of the News and TLS: Part II". Retrieved November 20, 2017. 
  62. ↑ "Hello HTTP/2, Goodbye SPDY". Chromium. February 9, 2015. Retrieved November 19, 2017. 
  63. ↑ Moreno, Paul (March 12, 2015). "Making Pinterest HTTPS". Pinterest Engineering via Medium. Retrieved November 20, 2017. 
  64. ↑ Riordan-Butterworth, Brendan (March 25, 2015). "Adopting Encryption: The Need for HTTPS". Interactive Advertising Bureau. Retrieved November 20, 2017. 
  65. ↑ Barnes, Richard (April 13, 2015). "Intent to deprecate: Insecure HTTP". Retrieved November 20, 2017. 
  66. ↑ "Mozilla Announces Plans to Deprecate HTTP in Firefox". The SEM Post. April 16, 2015. Retrieved November 20, 2017. 
  67. ↑ Scott, Tony (June 8, 2015). "Policy to Require Secure Connections across Federal Websites and Web Services" (PDF). Retrieved November 20, 2017. 
  68. ↑ Scott, Tony (June 8, 2015). "HTTPS-Everywhere for Government". Obama White House Archives. Retrieved November 20, 2017. 
  69. ↑ Williams, Martyn (June 8, 2015). "US to require HTTPS for all government websites. All public sites will be required to use the protocol by the end of 2016". Retrieved November 20, 2017. 
  70. ↑ Welinder, Yana; Baranetsky, Victoria; Black, Brandon (June 12, 2015). "Securing access to Wikimedia sites with HTTPS". Wikimedia Foundation. Retrieved September 25, 2016. 
  71. ↑ Thomas, Karl (June 15, 2015). "Wikipedia switches to HTTPS by default". WeLiveSecurity. Retrieved September 25, 2016. 
  72. ↑ Farivar, Cyrus (June 15, 2015). "Wikipedia goes all-HTTPS, starting immediately. "We believe that the time for HTTPS by default is now."". ArsTechnica. Retrieved September 25, 2016. 
  73. ↑ "Bing Moving to Encrypt Search Traffic by Default". Bing. June 15, 2015. Retrieved November 20, 2017. 
  74. ↑ Schick, Shane (June 22, 2015). "Microsoft to Make HTTPS a Default Setting for Bing". Retrieved November 20, 2017. 
  75. ↑ Lorenzo Franceschi-Bicchierai (June 17, 2015). "Reddit Switches to Encryption By Default. The internet giant will switch to HTTPS by default by the end of the month.". Vice. Retrieved November 19, 2017. 
  76. ↑ "reddit will soon only be available over HTTPS (self.redditdev)". Reddit. June 16, 2015. Retrieved November 19, 2017. 
  77. ↑ "Ads Take a Step Towards "HTTPS Everywhere"". Google AdWords. April 17, 2015. Retrieved November 20, 2017. 
  78. ↑ Anthony, Sebastian (October 14, 2015). "Chrome finally kills off the HTTP-HTTPS "mixed content" warning. Slightly alarming and not wholly useful yellow triangle is being retired.". Retrieved November 20, 2017. 
  79. ↑ Whittaker, Zack (October 14, 2015). "Chrome 46 loosens up on HTTPS 'mixed content' warnings. The browser -- known for being a bit overkill -- finally drops its yellow-warning attached to pages with both secure and non-secure content.". Retrieved November 19, 2017. 
  80. ↑ "Set an explicit "Origin When Cross-Origin" referer policy via the meta referrer tag". August 18, 2015. Retrieved March 10, 2017. 
  81. ↑ "Securing the web, together". Google Security Blog. March 15, 2016. Retrieved November 19, 2017. 
  82. ↑ Schwartz, Barry (March 16, 2016). "Google Report On HTTPS Adoption Within Google & The Top Web Sites". Search Engine Roundtable. Retrieved November 19, 2017. 
  83. ↑ "Google's Transparency Report to Include HTTPS Adoption Rates". Search Engine Journal. March 25, 2016. Retrieved November 19, 2017. 
  84. ↑ Chirgwin, Richard (March 23, 2016). "Google publishes list of Certificate Authorities it doesn't trust. Thawte experiment aims to expose issuers of dodgy creds". The Register. Retrieved November 20, 2017. 
  85. ↑ Tollman, Zack (April 28, 2016). "WE'RE GOING HTTPS: HERE'S HOW WIRED IS TACKLING A HUGE SECURITY UPGRADE". WIRED. Retrieved February 11, 2018. 
  86. ↑ Conger, Kate. "Apple will require HTTPS connections for iOS apps by the end of 2016". TechCrunch. Retrieved February 11, 2018.  Text "date June 14, 2016" ignored (help)
  87. ↑ Wilke, Nicole (June 15, 2016). "TechCrunch has gone HTTPS". Retrieved November 19, 2017. 
  88. ↑ "YouTube's road to HTTPS". YouTube. August 1, 2016. Retrieved November 19, 2017. 
  89. ↑ "Protecting Netflix Viewing Privacy at Scale". Netflix on Medium. August 8, 2016. Retrieved November 19, 2017. 
  90. ↑ "Netflix explains how and why it's switching to HTTPS streaming. Adding encryption increases privacy for viewers -- and for Netflix.". August 9, 2016. Retrieved November 19, 2017. 
  91. ↑ King, April (April 25, 2016). "Observatory by Mozilla: Making the Web Safer". Retrieved November 20, 2017. 
  92. ↑ Paganini, Pierluigi (August 27, 2016). "Mozilla launched the Observatory tool to test the security of websites". Retrieved November 20, 2017. 
  93. ↑ Konigsburg, Eitan; Wan, Vinessa (January 1, 2010). "HTTPS on NYTimes.com". New York Times Open blog. Retrieved November 19, 2017. 
  94. ↑ "Library Privacy Checklist - Overview". American Library Association. January 21, 2017. Retrieved April 13, 2019. 
  95. ↑ Murray, Brock (January 21, 2017). "Google Is Requiring HTTPS for Secure Data in Chrome". Retrieved November 19, 2017. 
  96. ↑ 96.0 96.1 Tung, Liam (April 28, 2017). "Google tightens noose on HTTP: Chrome to stick 'Not secure' on pages with search fields. In October, Google will begin phase two of its plan to label all HTTP pages as non-secure.". ZDNet. Retrieved November 15, 2017. 
  97. ↑ Faughan, Kate (January 4, 2017). "Update to the HTTPS Transition for Streams and Podcasts". National Public Radio. Retrieved February 11, 2018. 
  98. ↑ Barrett, Brian (March 30, 2017). "THE WORLD'S BIGGEST PORN SITE GOES ALL-IN ON ENCRYPTION". Wired. Retrieved November 9, 2017. 
  99. ↑ Garun, Natt (March 30, 2017). "Pornhub now turns on encryption by default". The Verge. Retrieved November 19, 2017. 
  100. ↑ Craver, Nick (May 22, 2017). "HTTPS on Stack Overflow: The End of a Long Road". Retrieved November 19, 2017. 
  101. ↑ Taylor, Anita (May 22, 2017). "How Stack Overflow Flipped the Switch on HTTPS". Stack Overflow. Retrieved November 19, 2017. 
  102. ↑ "360 Link: Springer Transition to https -- effective August 16, 2017". ExLibris Knowledge Center. August 7, 2017. Retrieved February 11, 2017. 
  103. ↑ "Switching to HTTPS". Springer Online Service on Freshdesk. September 6, 2017. Retrieved February 11, 2018. 
  104. ↑ "Defaulting to https (01-XX-2015) - Request fulfilled as of 09-13-2017!". January 29, 2015. Retrieved November 20, 2017. 
  105. ↑ Feit, Adrienne Porter; Barnes, Richard; King, April; Palmer, Chris; Bentzel, Chris; Tabriz, Parisa. "Measuring HTTPS adoption on the web". Retrieved November 20, 2017. 
  106. ↑ Feit, Adrienne Porter; Barnes, Richard; King, April; Palmer, Chris; Bentzel, Chris; Tabriz, Parisa. "Measuring HTTPS adoption on the web" (PDF). Retrieved November 20, 2017. 
  107. ↑ Sullivan, Nick (December 26, 2017). "Why TLS 1.3 isn't in browsers yet". Cloudflare. Retrieved January 28, 2018. 
  108. ↑ Aas, Josh (July 6, 2017). "Wildcard Certificates Coming January 2018". Let's Encrypt. Retrieved January 28, 2018. 
  109. ↑ "IMDb, as captured on April 13, 2018". April 13, 2018. Retrieved April 13, 2019. 
  110. ↑ "IMDb, as captured on April 14, 2018". April 14, 2018. Retrieved April 13, 2019. 
  111. ↑ "Why does IMDB use http and not HTTPS?". Quora. Retrieved April 13, 2019. 
  112. ↑ Schechter, Emily (February 8, 2018). "A secure web is here to stay". Google Security Blog. Retrieved February 11, 2018. 
  113. ↑ Lardinois, Frederic (February 8, 2018). "Chrome will soon mark all unencrypted pages as 'not secure'". TechCrunch. Retrieved February 11, 2018. 
  114. ↑ Bright, Peter (February 9, 2018). "From July on, Chrome will brand plain old HTTP as "Not secure". The "Not secure" label will go where the padlock would go for an encrypted connection.". ArsTechnica. Retrieved February 11, 2018. 
  115. ↑ Murnane, Kevin (July 25, 2018). "Fox News, ESPN And 9 Other Well-Known Websites That Chrome 68 Labels 'Not Secure'". Forbes. Retrieved April 13, 2019. 
  116. ↑ "Help:Fandom domain migration". Fandom Community Central. Retrieved April 13, 2019. 
Retrieved from "http://timelines.issarice.com/index.php?title=Timeline_of_HTTPS_adoption&oldid=29178"