Heck, my predecessor, Patrick Nohe, even started a White House petition to compel the General Services Administration (GSA) to add the .gov TLD to the global browser HSTS preload list<\/a> (although that didn\u2019t get enough votes \u2014 most likely because not enough people understood the importance of what he was trying to accomplish).<\/p>\n\n\n<\/span><\/span>\n\n\n\n Needless to say, this migration to HTTPS is happening a lot more slowly than we\u2019d like. But there is some good news that we\u2019re happy to share: The DotGov Program has announced their intention to add new .gov domains to the HSTS preload list<\/a> starting Sept. 1, 2020. This means that they\u2019re showing their commitment to serving all of their websites via the secure HTTPS protocol (eventually).<\/p>\n\n\n\n So, what does HSTS preloading mean for government website users and website security as a whole? And what does it mean for the future of HTTP?<\/p>\n\n\n\n Let\u2019s hash it out.<\/span><\/p>\n\n\n\n Simply put, HSTS \u2014 or what\u2019s also known as HTTP Strict Transport Security<\/a> \u2014 is a web security policy that forces a browser to only make secure HTTPS (Hypertext Transfer Protocol Secure) connections with the relevant website. Even if the user types in \u201chttp:\/\/,\u201d the browser will ignore that and use \u201chttps:\/\/\u201d anyway.<\/p>\n\n\n\n This is great, right? It means that it\u2019s going to force browsers to use a more secure connection no matter what. <\/em>However, there\u2019s one small caveat with HSTS: it uses a header to communicate the strict transport security parameter. This means that you\u2019d need to download the header before<\/em> your browser knows to always connect to the website via HTTPS in the future.<\/p>\n\n\n\n Because the policy communicates this way, it means that there\u2019s a small window of opportunity (before the browser downloads the header) in which hackers could swoop in during that first connection. Although it\u2019s a very narrow attack vector and, with the right tools, a bad guy could eliminate the SSL encryption connection and, ultimately, steal data or phish your users.<\/p>\n\n\n\n However, this is where HSTS preloading saves the day. The HSTS preload list is a set of websites that are hardcoded into browsers to employ strict transport security.<\/strong> What this means is that when someone connects to a website on the HSTS preload list for the first time, the browser already knows that it must connect only using an HTTPS connection, thereby eliminating that small window of opportunity for hackers.<\/p>\n\n\n\n So, by adding government websites to the HSTS preload list, it means that all of the browsers using the list will already know that they can only connect using HTTPS. (Hence why it\u2019s call \u201cHSTS preloading, because you\u2019re preloading the list with those specific domains.)<\/p>\n\n\n\n An additional added benefit of HSTS preloading is that users will experience faster page load speeds because the browsers will no longer require server redirects from HTTP to HTTPS. Sounds like a real win-win, if you ask me.<\/p>\n\n\n\n But why is HSTS preloading \u2014 and using HTTPS in general \u2014 really necessary? Let\u2019s take a moment for a quick refresher on how data transmits across the internet for sites that don\u2019t use HTTPS.<\/p>\n\n\n\n Any info that\u2019s sent between two parties (for example, your end users\u2019 web browser and the website they\u2019re connected to) via the internet is sent in plaintext format. This means that any data sent using HTTP can be intercepted and read by anyone<\/strong> \u2014 your nosy neighbor Tim, your employer, government entities, or a random (and potentially malicious) hacker.<\/p>\n\n\n\n Not only is this a big privacy issue, but it\u2019s also a security issue that can result in identity theft and a litany of other types of cybercrimes.<\/p>\n\n\n\n In a nutshell, HTTPS is a connection made via the transport layer security, which is a combination of encryption and digital signatures<\/a>. This type of connection enables the communication channel between the two parties to be encrypted to ensure data transmissions are secure.<\/p>\n\n\n\n According to the DotGov website:<\/p>\n\n\n\n \u201cHTTPS is a key protection for websites and web users. It offers security and privacy when connecting to the web, and provides governments the assurance that what they publish is what is delivered to users. In the last few years, HTTPS has become the default connection type on the web.\u201d<\/em><\/p><\/blockquote>\n\n\n\n Google\u2019s latest Transparency Report data<\/a> (as of June 13, 2020) shows that 95% of users connect via HTTPS:<\/p>\n\n\n\n And this is great \u2014 95% of users is the overwhelming majority. But it\u2019s still not at the level that website users need it to be. For a truly secure internet, this number should be at the full 100%. But, hey, we understand that Rome wasn\u2019t built in a day. And considering that the internet was originally built for government use (for scientists and researchers to share data) and not for the personal or commercial use it\u2019s evolved to today, it\u2019s a little<\/em> understandable why these changes take time.<\/p>\n\n\n\n It\u2019s important to note, however, that while HTTPS only guarantees the integrity of the connection between two parties or systems \u2014 it doesn\u2019t guarantee that the system or website that an individual connects to is legitimate.<\/strong> So, you could be securely connected to a website, but HTTPS doesn\u2019t ensure that it\u2019s the real<\/em> site. This is the difference between being \u201csafe\u201d and being \u201csecure\u201d \u2014 it\u2019s also where fake\/phishing websites<\/a> can really<\/em> ruin your day.<\/p>\n\n\n\n Using encryption on a website isn\u2019t going to do you any good if you\u2019re connecting to a hacker\u2019s device instead of the legitimate server. However, there is a solution: install a minimum of organization validated (OV) SSL\/TLS certificates on your web server. By using an OV (or extended validation) SSL\/TLS certificate on your website, you\u2019re ensuring that any data transmitted between users and your website is secure by:<\/p>\n\n\n\n Using an SSL\/TLS certificate to facilitate an HTTPS connection helps to protect users against eavesdropping and man-in-the-middle (MitM) attacks. But OV\/EV SSL takes security a step further by adding identity assurance that validates the identity of the organization, government, or business to whom a website belongs.<\/p>\n\n\n<\/span><\/span>\n\n\n\n For starters, this mass move to HTTPS via HSTS preloading is obviously a great security measure. However, it\u2019s not perfect and still means we have a long way to go. Despite the fact that Google pretty much made HTTPS mandatory for websites to rank several years ago, not all government websites have migrated to HTTPS<\/a>.<\/strong> For example, the Florida Department of Health<\/a> website loads via the insecure HTTP connection:<\/p>\n\n\n\n The same can be said about the New York State Library website:What Is HSTS Preloading and Why Does It Mean Greater Security for End Users?<\/h2>\n\n\n\n
How Data Transfers Across the Internet Without the Use of HTTPS<\/h2>\n\n\n\n
HTTPS Secures Data in Transit<\/h3>\n\n\n\n
![\"A](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/06\/google-transparency-https-traffic-1024x627.png\"){kind=spacer}
Where SSL\/TLS Certificates Come Into Play for Website Security<\/h3>\n\n\n\n
30,000 Foot Perspective: What This Shift to HTTPS (via HSTS Preloading) Means<\/h2>\n\n\n\n
![\"Screenshot](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/06\/florida-dept-of-health-insecure-website-1024x306.png\")
<\/p>\n\n\n\n
![\"A](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/06\/ny-state-library-1024x480.png\")