Whitehouse Mandates HTTPS For Government Sites and Services

Bismillah writes: As per orders from Tony Scott, the government CIO, all federal agencies with publicly accessible websites must provide service only through a secure HTTPS connection. "Federal websites that do not convert to HTTPS will not keep pace with privacy and security practices used by commercial organizations, and with current and upcoming Internet standards," according to his memo. "This leaves Americans vulnerable to known threats, and may reduce their confidence in their government."

Comments

Many are already using HTTPS and IPv6

[WillAffleckUW]

It's not like this is a new initiative, or that we didn't have dry runs a few years ago.

It's just a few recalcitrant holdouts being told: "Switch or Die".

Re:Require .gov TLD ?

[ShanghaiBill]

and .edu, I'd guess.

Those are almost all state, local, or private. But there are a few run by the feds, such as www.usma.edu and www.usna.edu, which default to vanilla http.

Re:Oh the irony

[Qzukk]

you mean like thinking HTTPS stops anyone from seeing the URL you just visited so they can view it for themselves?

... it does, unless you've got some spyware installed phoning home every URL you visit. Or chrome, but I repeat myself.

Thanks to SNI and IPv4 forcing everyone to host multiple sites on one address (but I repeat myself) SSL does now leak the hostname you are attempting to request during the handshake so the server can select a certificate.