diff --git a/index.md b/index.md index 13ee4d7..7ae4f44 100644 --- a/index.md +++ b/index.md @@ -30,9 +30,9 @@ By using private connections by default, changed expectations make everyone safe By always using HTTPS, web services don't have to make a subjective judgment call about what's "sensitive". This leaves less room for error, and makes deployment simpler and more consistent. -Widespread HTTPS uses also means that clients can begin assuming HTTPS with more confidence. Attacks designed to track large quantities of unencrypted traffic become less attractive. +Widespread use of HTTPS also means that clients can begin assuming HTTPS with more confidence. Attacks designed to track large quantities of unencrypted traffic become less attractive. -Web browsers can begin displaying HTTPS connections as normal, and HTTP connections as non-secure. HTTPS validation vailures can become more strict, reducing the effectiveness of phishing and user error. +Web browsers can begin displaying HTTPS connections as normal, and HTTP connections as non-secure. HTTPS validation failures can become more strict, reducing the effectiveness of phishing and user error. These changed expectations improve the security of HTTPS on every website. In other words, **protecting non-sensitive sites strengthens the protections of sensitive sites**. diff --git a/pages/resources.md b/pages/resources.md index f245c86..bccd383 100644 --- a/pages/resources.md +++ b/pages/resources.md @@ -10,9 +10,17 @@ permalink: /resources/ * Ben Balter: [Why you should care about HTTPS, even if you have nothing to hide](http://ben.balter.com/2015/01/06/https-all-the-things/) * Washington Post: [Federal sites leaked the locations of people seeking AIDS services for years](http://www.washingtonpost.com/blogs/the-switch/wp/2014/11/07/federal-sites-leaked-the-locations-of-people-seeking-aids-services-for-years/) * Washington Post: [The federal government’s online privacy watchdog just made its Web site more secure](http://www.washingtonpost.com/blogs/the-switch/wp/2015/03/06/the-federal-governments-online-privacy-watchdog-just-made-its-web-site-more-secure/) +* Washington Post: [Your browser may soon force you to connect securely to some U.S. government Web sites](http://www.washingtonpost.com/blogs/the-switch/wp/2015/02/11/your-browser-may-soon-force-you-to-connect-securely-to-some-u-s-government-web-sites/) +* The Hill: [FTC enables default encryption](http://thehill.com/policy/technology/234873-ftc-enables-default-encryption) +* The Hill: [White House website goes secure](http://thehill.com/policy/technology/235323-white-house-website-goes-secure) * 18F: [The first .gov domains hardcoded into your browser as all-HTTPS](https://18f.gsa.gov/2015/02/09/the-first-gov-domains-hardcoded-into-your-browser-as-all-https/) * FTC: [Government agencies enable HTTP Strict Transport Security for public websites](http://www.ftc.gov/news-events/blogs/techftc/2015/02/government-agencies-enable-http-strict-transport-security-public) * FTC: [FTC.gov is now HTTPS by default](https://www.ftc.gov/news-events/blogs/techftc/2015/03/ftcgov-now-https-default) +* Fast Company: [The Fight for HTTPS](http://www.fastcompany.com/3036430/the-fight-for-https) +* E Pluribus Unum: [White House moves WhiteHouse.gov to HTTPS by default, tying privacy to security](http://e-pluribusunum.com/2015/03/11/white-house-moves-whitehouse-gov-to-https-by-default-tying-privacy-to-security/) +* Motherboard: [Whitehouse.gov Is Now Secure By Default, Signaling a Trend in Government](http://motherboard.vice.com/read/whitehouse-site-is-now-secure-by-default-signaling-a-trend-in-government) +* NextGov: [WhiteHouse.gov Finally Gets Boosted Encryption](http://www.nextgov.com/cybersecurity/2015/03/white-house-dot-gov-website-use-https-encryption/107223/?oref=river) + ### Internet standards movement @@ -24,6 +32,7 @@ permalink: /resources/ * Google [gives a search ranking boost](http://googlewebmastercentral.blogspot.com/2014/08/https-as-ranking-signal.html) to HTTPS sites. * Chrome plans to [mark HTTP as non-secure](https://www.chromium.org/Home/chromium-security/marking-http-as-non-secure). * Chrome also plans to [restrict some features to HTTPS sites](https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/2LXKVWYkOus), including geolocation. +* Electronic Freedom Foundation's [HTTPS-Everywhere Project](https://www.eff.org/https-everywhere) ### Standards and tools