1 of 38

Real Talk About HTTPS

Emily Stark

@estark37

2 of 38

What does HTTP mean?

3 of 38

What does HTTP mean?

4 of 38

What does HTTP mean?

5 of 38

What does HTTP mean?

6 of 38

Being honest about what HTTP means

7 of 38

In this talk...

​

  • HTTPS usage today

​

  • What Chrome is doing to help you use HTTPS

​

  • Omnibox changes coming soon to a Chrome near you

​

8 of 38

Real talk: HTTPS usage in Chrome

​

9 of 38

10 of 38

41 of the top sites support HTTPS.

(+12 since February 2016)

11 of 38

% of pages loaded over HTTPS

https://www.google.com/transparencyreport/https/metrics/

12 of 38

% time spent on HTTPS

https://www.google.com/transparencyreport/https/metrics/

13 of 38

Behind the numbers

14 of 38

Functionality

15 of 38

Functionality

16 of 38

Functionality

[K]ey features of certain products, such as the location-finding feature within the Homepage, Travel News and Weather sites, would stop working if we didn’t enable HTTPS for those services.

  • BBC.co.uk Internet Blog (https://goo.gl/etPr8R)

17 of 38

Performance

18 of 38

Performance

When we launched [HTTPS], we saw an average of a 50ms hit for negotiation… it was more than offset when we activated HTTP/2 a month later and saw an overall drop of ~250ms per pageview on supported devices.

​

​

  • Weather.com

19 of 38

We need your help!

20 of 38

Each false alarm reduces the credibility of a warning system.

- “Cry wolf: the psychology of false alarms”�Shlomo Breznitz 1984

21 of 38

Help is on the way!

​

22 of 38

Free, easy certificates

Let’s Encrypt is a trademark of the Internet Security Research Group.

Crowdfunding now! https://letsencrypt.org/2016/11/01/launching-our-crowdfunding-campaign.html

23 of 38

24 of 38

Improving internal support for HTTPS

All ads that come from any Google source always support HTTPS, including AdWords, AdSense, or DoubleClick Ad Exchange...

- “Here’s to more HTTPS on the web!”, Google Security Blog (Nov 3, 2016)

25 of 38

Improving internal support for HTTPS

We saw no material impact to AdX revenue with the transition to SSL.

- Jason Tollestrup, Director of Programmatic Advertising for the Washington Post

26 of 38

Improving internal support for HTTPS

“Should I move my site all at once or bit by bit?”

“Will I see a drop in search?”

“What do I do with robots.txt?”

27 of 38

Improving internal support for HTTPS

FAQs:

28 of 38

Improving internal support for HTTPS

https://developers.google.com/web/fundamentals/security/encrypt-in-transit/enable-https

29 of 38

Improving internal support for HTTPS

​

We successfully completed our move of CNET.com to HTTPS last month. Since then, there has been no change in our Google rankings or Google organic search traffic.

  • John Sherwood, Vice President of Engineering & Technology at CNET

30 of 38

Web platform and browser tools

Chrome DevTools Security Panel

https://developers.google.com/web/tools/chrome-devtools/security

31 of 38

The very near future

​

32 of 38

Coming in Chrome 56 (Jan 2017)

For HTTP pages with passwords or credit card fields

33 of 38

Try it out in Chrome Canary today

  1. Download Canary from https://www.google.com/chrome/browser/canary.html
  2. Flip #mark-non-secure-as in chrome://flags

34 of 38

35 of 38

It’s not all bad

Chrome 55 (currently in beta)

36 of 38

https://security.googleblog.com/2016/09/moving-towards-more-secure-web.html

37 of 38

Conclusion

  • HTTPS usage is increasing, slowly but steadily.

​

  • We need your help to keep moving forward!

​

  • Chrome is easing users into the idea that insecure HTTP is bad.

38 of 38

Thank you!

Emily Stark

@estark37