Year: 2025
Type: conference-paper
Abstract: The web was originally developed in an attempt to allow scientists from around the world to share information efficiently.As the web evolved, the threat model for the web evolved as well.While it was probably acceptable for research to be freely shared with the world, current use cases like online shopping, media consumption or private messaging require stronger security safeguards which ensure that network attackers are not able to view, steal, or even tamper with the transmitted data.Unfortunately the Hypertext Transfer Protocol (http) does not provide any of these required security guarantees.The Hypertext Transfer Protocol Secure (https) on the other hand allows carrying http over the Transport Layer Security (TLS) protocol and in turn fixes these security shortcomings of http by creating a secure and encrypted connection between the browser and the website.While the majority of websites support https nowadays, https remains an opt-in mechanism that not everyone perceives as necessary or affordable.In this paper we evaluate the state of https adoption on the web.We survey different mechanisms which allow upgrading connections from http to https, and provide real world browsing data from over 140 million Firefox release users.We provide numbers showcasing https adoption in different geographical regions as well as on different operating systems and highlight the effectiveness of the different upgrading mechanisms.In the end, we can use this analysis to make actionable suggestions to further improve https adoption on the web.Another very important milestone towards increasing the availability of https was the launch of the Let's Encrypt initiative [22].Let's Encrypt was the first global Certificate Authority (CA) service that allowed website owners to automatically obtain free browser-trusted certificates, needed to provide https connections for their websites.Presumably, search engines boosting a site's rank when available over https [11] also had a positive effect.Furthermore, browser vendors have started to build various customized flavors of upgrading mechanisms directly into their engines.Chromium, the rendering engine powering Chrome, Brave, Edge and more, Firefox with its underlying engine Gecko, as well as Safari on top of Webkit have started to deploy upgrading mechanisms [3], [20], [28], [59].All of these efforts highlight the importance for the web community to continuously deliver more content over a secure and encrypted connection.Generally a web page is transferred by first, a top-level document load, followed by various sub-resource loads.
Language: English
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: gold
OpenAlex ID: W4413183614