|
1 | 1 | --- |
2 | | -layout: default |
3 | | -title: HTTPS in the government |
| 2 | +layout: page |
| 3 | +title: HTTPS in .gov |
4 | 4 | permalink: / |
5 | 5 | --- |
6 | 6 |
|
7 | | -HTTPS (`https://`) provides a secure, private connection across the public internet. Plain HTTP (`http://`) connections can be easily intercepted, manipulated, and impersonated. |
| 7 | +HTTPS (`https://`) provides a secure, private connection across the public internet. Plain HTTP (`http://`) connections are insecure, and can be easily intercepted, manipulated, and impersonated. |
8 | 8 |
|
9 | | -In today's internet, and today's browsers, HTTPS is a helpful baseline for _all_ government websites, no matter how small or how static. |
| 9 | +In today's internet, and today's browsers, HTTPS is a helpful baseline for _all_ government websites, no matter how small or how sensitive. |
10 | 10 |
|
11 | | -This website is a manual and support system for deploying HTTPS in the US federal government. |
| 11 | +Read [the FAQ](/faq/) for more commonly asked questions. |
12 | 12 |
|
13 | | -## Why HTTPS? |
| 13 | +### Why HTTPS for everything? |
14 | 14 |
|
15 | | -When properly configured, an HTTPS connection guarantees three things: |
| 15 | +HTTPS makes sense for all websites, even smaller or more "non-sensitive" websites. |
16 | 16 |
|
17 | | -* **Privacy.** The visitor's connection is encrypted, obscuring URLs, cookies, and other sensitive metadata. |
18 | | -* **Authentication.** The visitor is talking to the "real" website, and not to an impersonator or through a "man-in-the-middle". |
19 | | -* **Integrity.** The data sent between the visitor and the website has not been tampered with or modified. |
| 17 | +As encrypted traffic becomes more widespread and more normal, web browsers and other clients can begin assuming HTTPS with more confidence. This means more new web functionality can require HTTPS to function, and that browsers can reduce the likelihood of phishing and user error by making failure modes more strict. |
20 | 18 |
|
21 | | -These properties have been considered an absolute requirement for highly sensitive services (e.g. password login forms, or bank accounts) for many years. |
| 19 | +In other words, **protecting non-sensitive sites strengthens the protections of sensitive sites**, by allowing browsers and clients to offer much stronger guarantees and warnings when those protections break down. |
22 | 20 |
|
23 | | -## Why HTTPS everywhere? |
| 21 | +Additionally, a policy of always using HTTPS means not having to engineer a boundary around "sensitive" parts of the application, or to judge where those lines should be drawn. This reduces room for error, and simplifies technical deployment. |
24 | 22 |
|
25 | | -Over the last several years, the internet's standards bodies, web browsers, and community of practice have come to understand that these properties should be the baseline for all web traffic. |
| 23 | +Finally, unencrypted traffic is subject to blanket monitoring and tracking across all websites a user visits, without user consent. These kinds of attacks are commonplace today across the world, and bring into question whether there is such a thing as "non-sensitive" traffic. These attacks are defeated by HTTPS, and so fare made infeasible by increasing the overall rate of encrypted traffic. |
26 | 24 |
|
27 | | -The GSA's [18F](https://18f.gsa.gov) team has written about [why they use HTTPS for every .gov they make](https://www.gov.uk/service-manual): |
| 25 | +### HTTPS is the internet's next phase |
28 | 26 |
|
29 | | -> The `.gov` in government websites carries a lot of weight. Citizens expect government websites to be secure, trustworthy, and reliable. Citizens expect anything they read on a `.gov` website to be official, and they expect any information they submit to that website — especially if they're submitting personal information — to be sent safely and only to the government. |
30 | | -> |
31 | | -> ... |
32 | | -> |
33 | | -> [Security, privacy, and speed] are useful for all of our applications, all of the time — not just when passwords or personal information are involved. By simply deploying HTTPS all of the time, we don't have to engineer a boundary around "sensitive" parts of the application, or judge where those lines should be drawn. |
| 27 | +Over the last several years, the internet's standards bodies, web browsers, major tech companies, and the internet community of practice have all come to understand that HTTPS should be the baseline for all web traffic. |
34 | 28 |
|
35 | | -Many major organizations have reached the same conclusion: |
36 | | - |
37 | | -* The UK government requires that [every government service use HTTPS](https://www.gov.uk/service-manual/domain-names/https.html). |
38 | | -* The internet's standards body (the IETF) and its parent organization (the Internet Society) have both stated that [encryption should be the norm on the internet](http://www.internetsociety.org/news/internet-society-commends-internet-architecture-board-recommendation-encryption-default). |
39 | | -* The technical architecture group at the W3C (the web's standards body) has declared that [the web should move to HTTPS](https://w3ctag.github.io/web-https/). |
| 29 | +* The W3C's Technical Architecture Group has found that [the web should actively prefer secure connections](https://w3ctag.github.io/web-https/) and transition entirely to HTTPS. |
| 30 | +* The IETF has said that [pervasive monitoring is an attack](https://datatracker.ietf.org/doc/rfc7258/), and the Internet Architecture Board (the IETF's parent organization) recommends that [new protocols use encryption by default](http://www.internetsociety.org/news/internet-society-commends-internet-architecture-board-recommendation-encryption-default). |
40 | 31 | * Google [favors HTTPS websites in search rankings](http://googleonlinesecurity.blogspot.com/2014/08/https-as-ranking-signal_6.html), and the Chrome security team is working on [gradually marking plain HTTP as non-secure](https://www.chromium.org/Home/chromium-security/marking-http-as-non-secure). |
41 | 32 |
|
42 | 33 | Ultimately, the internet's goal is to establish encryption as the norm, and to phase out unencrypted connections. |
43 | 34 |
|
44 | | -It's important to realize that investing in HTTPS makes it faster, cheaper, and easier for everyone. Many of the advancements of the last several years have come from major institutions and technology companies committing to migrate, improving the status quo, and contributing their improvements back to the public. |
| 35 | +Investing in HTTPS makes it faster, cheaper, and easier for everyone. Many of the advancements of the last several years have come from major institutions and technology companies committing to migrate, improving the status quo, and contributing their improvements back to the public. |
45 | 36 |
|
46 | 37 | The more US government websites and services that join the transition to an encrypted internet, the smoother and faster it will be. |
| 38 | + |
0 commit comments