As noted by Mark Nottingham, chair of the IETF HTTP Working Group, industry practice when it comes to the HTTP/HTTPS debate has been to err on the side of carrot rather than stick — give users and developers a reason to opt in and convert to HTTPS rather than trying to compel their obedience. Now, the Mozilla Foundation has announced a different tactic: In the near future, all new features in its Firefox browser will only be available to secure websites. But will this new HTTPS requirement really work better than the “carrots” to produce a more secure Web, or is this stick just too sharp?

Get Secure or Get Out

According to InfoWorld, while there’s no firm date for the Firefox switch-over, the consequence of not going HTTPS was made clear by Mozilla: Without a secure connection, specific features — especially those related to users’ security and privacy — will be instantly disabled in the browser, while new developments will be off-limits until developers and websites can show they’re HTTPS-compliant. But why toss out the carrot of faster protocols and better encryption to lure HTTPS converts and instead opt for an ultimatum?

Part of the reason is Let’s Encrypt, a certificate authority co-sponsored by Mozilla. The idea behind Let’s Encrypt is to provide free TLS certificates to any domain name owner, effectively removing the problems of cost and ongoing management. In effect, the Mozilla Foundation sees HTTPS as the future of Web security, and it believes it has the tools to make HTTPS less of a chore and more of a certainty.

Not surprisingly, there’s some pushback. Cryptography software developer Sven Slootweg, for example, wrote on his blog that Let’s Encrypt may not account for things like the developer use of wild-card domains, effectively locking them out of features even though they’ve done nothing wrong. He also argues that the HTTPS requirement goes against the idea of an open Web. However, Mozilla stated that it is looking for user feedback before setting a firm date for the switch, giving users ample time to make the necessary changes and comply with Firefox.

“Transitioning the Web to HTTPS is going to take some time, so whatever a website does today, it will still work for months or years,” Firefox Security Lead Richard Barnes told Tom’s Hardware.

Strange Security?

Not all companies agree that HTTPS is the way of the future. Facebook, for example, is willing to provide free Internet access for users in countries such as India, Tanzania, Kenya and Colombia through its Internet.org initiative, but only for sites that don’t use HTTPS, The Register reported. The social media giant says that this “walled garden” program is necessary because its servers can’t support HTTPS and will either have all encryption stripped or simply be rejected. Micheal Horowitz of Computerworld, meanwhile, argued that HTTPS is in large measure smoke and mirrors. While browsers could do things like periodically validate their list of trusted root CAs, right now there’s more value in the “S” than what’s underneath.

Mozilla and other search giants don’t see it this way. While HTTPS isn’t perfect, the idea is to use it as a launching pad for other security developments and make the Web a safer place along the way. The problem? The HTTPS requirement might also make the Web less open-ended and more invite-only.

More from

When the Absence of Noise Becomes Signal: Defensive Considerations for Lazarus FudModule

In February 2023, X-Force posted a blog entitled “Direct Kernel Object Manipulation (DKOM) Attacks on ETW Providers” that details the capabilities of a sample attributed to the Lazarus group leveraged to impair visibility of the malware’s operations. This blog will not rehash analysis of the Lazarus malware sample or Event Tracing for Windows (ETW) as that has been previously covered in the X-Force blog post. This blog will focus on highlighting the opportunities for detection of the FudModule within the…

LastPass Breaches Cast Doubt on Password Manager Safety

In 2022, LastPass suffered a string of security breaches which sparked concern among cyber professionals and those impacted by the intrusions. Some called into question the way LastPass handled and responded to the incident. In addition, the situation ignited a wider conversation about the risks linked to utilizing password managers.A password manager helps users generate strong passwords and safeguards them within a digital locker. A master password secures all data, which enables users to conveniently access all their passwords for…

The Role of Finance Departments in Cybersecurity

Consumers are becoming more aware of the data companies collect about them, and place high importance on data security and privacy. Though consumers aren’t aware of every data breach, they are justifiably concerned about what happens to the data companies collect. A recent study of consumer views on data privacy and security revealed consumers are more careful about sharing data. The majority of respondents (87%) say they wouldn’t do business with companies that appear to have weak security. Study participants also…

The One Place IT Budget Cuts Can’t Touch: Cybersecurity

If IT spending is slowing, will business leaders follow a similar approach for cybersecurity budgets? Probably not. Gartner predicts that end-user spending on both security technology and services will see an annual growth rate of 11% over the next four years. And the market is anticipated to reach $267.3 billion in 2026. Many security professionals agree that security spending cuts aren’t likely. Given the current threat landscape, strong security has quickly become a business imperative. Security has become the highest…