May 7, 2015 By Douglas Bonderud 2 min read

As noted by Mark Nottingham, chair of the IETF HTTP Working Group, industry practice when it comes to the HTTP/HTTPS debate has been to err on the side of carrot rather than stick — give users and developers a reason to opt in and convert to HTTPS rather than trying to compel their obedience. Now, the Mozilla Foundation has announced a different tactic: In the near future, all new features in its Firefox browser will only be available to secure websites. But will this new HTTPS requirement really work better than the “carrots” to produce a more secure Web, or is this stick just too sharp?

Get Secure or Get Out

According to InfoWorld, while there’s no firm date for the Firefox switch-over, the consequence of not going HTTPS was made clear by Mozilla: Without a secure connection, specific features — especially those related to users’ security and privacy — will be instantly disabled in the browser, while new developments will be off-limits until developers and websites can show they’re HTTPS-compliant. But why toss out the carrot of faster protocols and better encryption to lure HTTPS converts and instead opt for an ultimatum?

Part of the reason is Let’s Encrypt, a certificate authority co-sponsored by Mozilla. The idea behind Let’s Encrypt is to provide free TLS certificates to any domain name owner, effectively removing the problems of cost and ongoing management. In effect, the Mozilla Foundation sees HTTPS as the future of Web security, and it believes it has the tools to make HTTPS less of a chore and more of a certainty.

Not surprisingly, there’s some pushback. Cryptography software developer Sven Slootweg, for example, wrote on his blog that Let’s Encrypt may not account for things like the developer use of wild-card domains, effectively locking them out of features even though they’ve done nothing wrong. He also argues that the HTTPS requirement goes against the idea of an open Web. However, Mozilla stated that it is looking for user feedback before setting a firm date for the switch, giving users ample time to make the necessary changes and comply with Firefox.

“Transitioning the Web to HTTPS is going to take some time, so whatever a website does today, it will still work for months or years,” Firefox Security Lead Richard Barnes told Tom’s Hardware.

Strange Security?

Not all companies agree that HTTPS is the way of the future. Facebook, for example, is willing to provide free Internet access for users in countries such as India, Tanzania, Kenya and Colombia through its initiative, but only for sites that don’t use HTTPS, The Register reported. The social media giant says that this “walled garden” program is necessary because its servers can’t support HTTPS and will either have all encryption stripped or simply be rejected. Micheal Horowitz of Computerworld, meanwhile, argued that HTTPS is in large measure smoke and mirrors. While browsers could do things like periodically validate their list of trusted root CAs, right now there’s more value in the “S” than what’s underneath.

Mozilla and other search giants don’t see it this way. While HTTPS isn’t perfect, the idea is to use it as a launching pad for other security developments and make the Web a safer place along the way. The problem? The HTTPS requirement might also make the Web less open-ended and more invite-only.

More from

Crisis communication: What NOT to do

4 min read - Read the 1st blog in this series, Cybersecurity crisis communication: What to doWhen an organization experiences a cyberattack, tensions are high, customers are concerned and the business is typically not operating at full capacity. Every move you make at this point makes a difference to your company’s future, and even a seemingly small mistake can cause permanent reputational damage.Because of the stress and many moving parts that are involved, businesses often fall short when it comes to communication in a crisis.…

The future of cybersecurity: What to expect at Black Hat 2024

3 min read - The cybersecurity landscape continues to evolve at a breakneck pace. New threats emerge daily, and the stakes have never been higher, especially as artificial intelligence (AI) is infused into every aspect of business. As security and business leaders, it's crucial to stay ahead of the curve and ensure your organization is equipped to handle the ever-changing threat landscape. For over two decades, Black Hat has been the premier gathering of cybersecurity professionals, providing a platform for experts to share knowledge,…

Recent CrowdStrike outage: What you should know

3 min read - On Friday, July 19, 2024, nearly 8.5 million Microsoft devices were affected by a faulty system update, causing a major outage of businesses and services worldwide. This equates to nearly 1% of all Microsoft systems globally and has led to significant disruptions to airlines, police departments, banks, hospitals, emergency call centers and hundreds of thousands of other private and public businesses. What caused this outage in Microsoft systems? The global outage of specific Microsoft-enabled systems and servers was isolated to…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today