Chrome: towards HTTPS by default
For the past several years, more than 90% of Chrome users’ navigations have been to HTTPS sites, across all major platforms. Thankfully, that means that most traffic is encrypted and authenticated, and thus safe from network attackers. However, a stubborn 5-10% of traffic has remained on HTTP, allowing attackers to eavesdrop on or change that data. Chrome shows a warning in the address bar when a connection to a site is not secure, but we believe this is insufficient: not only do many people not notice that warning, but by the time someone notices the warning, the damage may already have been done. We believe that the web should be secure by default. HTTPS-First Mode lets Chrome deliver on exactly that promise, by getting explicit permission from you before connecting to a site insecurely. Our goal is to eventually enable this mode for everyone by default. While the web isn’t quite ready to universally enable HTTPS-First Mode today, we’re announcing several important stepping stones towards that goal. It’s definitely going to be tough to get those last few percentages converted to HTTPS, and due to Chrome’s monopolistic influence on the web, any steps it takes will be felt by everyone.