Against HTTPS

Tim Berners-Lee reflects on the introduction of https as a trigger for more secure communication. The arguments 20 years ago were divided. Simple minded arguments for https everywhere are even more shallow today. w3c

Some people feel that in fact looking back the decision to make the https: URI space was in fact even at that time a mistake. Now also, you can argue that things have changed in that people are individually more aware, and individually under attack. It is not now the link maker's task to ensure the user is secure. It is the user's task to ensure that their interactions are secure.

The Same Origin Policy in this spirit suggests that once a user enters the secure web by an https: link, then everything which affects the session at all must come also over authenticated TLS. This has led to a class of web apps being broken, in contrast with the usual rule of back compatibility with old content.

The last point is related to the common design failure that trust is as single-valued scalar thing. It has been more any more clear that we and our systems should not just trust things or not trust them, or even to trust them on a scale form 0 to 1. We trust different people for different things.

The HTTPS Everywhere campaign taken at face value completely breaks the web. In a way it is arguably a greater threat to the integrity for the web than anything else in its history.