The other day this topic came up in chat, so I thought it would be good to have it settled officially.

Which, if any, internet protocol should be encouraged for users inserting links into their posts? Each option has pros and cons, some of the most relevant being:

• http is the old standard, most likely to work for a variety of users. It is less likely to run into trouble for non-techie users behind corporate firewalls for instance.
• https is newer (but not cutting-edge). It is more secure in the sense that you are more sure that you are receiving data from a trusted source. At the same time, it can be slightly slower.
• Of course, anyone pro enough to actually know how their browser works under the hood (yes, you, Manishearth) can easily have their own preferences override what the link says, or do all sorts of other black magic to dodge this problem altogether (and steal my credit card at the same time, no doubt).

Now, I don't think anyone believes so strongly as to mandate one or the other, and I don't even see the issue as big enough to warrant changing old posts en masse. I'm just wondering if there is a preferred style I should be using. If there is, I can also edit links accordingly while making other, more substantive changes to posts.

• Thank you for your credit card. As a bonus, I have your bank details as well ;-) – Manishearth Apr 23 '13 at 2:42

Firstly, note that very few sites offer both HTTP and HTTPS. There's only one that I can think of -- Wikipedia. GMail used to; but we don't link to GMail on Phys.SE and it's pure HTTPS now anyway.

What is HTTPS, and how does it work?

See this post if you're interested to know more. Or, y'know, Google it.

It is simply a protocol that prevents snooping and manipulation by intermediate entities on the network.

What happens is that when you ask for an https website, the first thing it does is hand you a certificate. The certificate basically says "I am who I am", and is generally digitally "signed" by some trusted entity that your browser knows(many times there are intermediate signing entities). Note that due to the signing path, this cannot be spoofed.

This certificate forms the basis of all the coming cryptography -- it acts as an initial transfer of public keys. Any further transfer of data will be hidden (except for the URLs you access) using this certificate and a prime number you generated as keys. Each party has a public and private key: Using my private key and (say) Wikipedia's public key, I can encrypt a message that can only be decrypted using my public key and Wikipedia's private key. The reverse works as well. Since the intermediate parties only have the public keys, they cannot send fake messages, nor can they read the messages being sent.

When is it necessary?

When you:

• Don't want the information you're receiving to be modified: For example if I'm downloading Chrome, I wouldn't want an attacker to sit in the middle of my connection with Google, pretend to be Google, and hand me their version of Chrome.

• Don't want the information being sent to be snooped/modified: The easiest example of this is credit card/bank details. If I submit a form containing these details, I probably should only do so on a trusted HTTPS connection where I trust the site, and they have a security certificate verifying their identity (Most browsers display a green lock and the title of the company in the address bar). If it's not on a trusted connection, my ISP, proxy servers, and other entities in between can read these and steal my money.

Is it necessary for https Wikipedia links?

Not really, no. Unless you are blindly going to use the information given on Wikipedia to do something (run some code or mess around with chemicals: you don't want Wikipedia urging you to add FOOF to your baking soda and vinegar experiment), there isn't much point in using https when you are just reading stuff. URLs are visible to men in the middle anyway, so if your government hates Wikipedia, they'll still come to know. (You can bypass this using SSH tunneling or web proxies)

Wikipedia HTTPS is really meant for those who edit/contribute to Wikipedia: They are submitting passwords and other stuff and would like it to stay secure. Plus, there are those with access to privately identifying information like IPs nad emails for whom it is a matter of trying to keep private info private.

However, there are some other uses as well. Generally, those who use HTTPS for these reasons know how to tack an s onto the URL themselves :)

Does https have any problems?

Yep. Firstly, as you noted, it's slightly slower. Not enough to make a difference while browsing Wikipedia, though.

Secondly, not all proxy servers like it. Using HTTPS over an HTTP proxy (which is what most institutes and workplaces use -- SOCKS proxies are rare) requires a protocol-switching thing known as HTTP CONNECT, and not all proxies allow that on port 443 (where HTTPS runs).

Those behind such proxies usually know how to deal with this -- just chop the s right out of the URL.

What should our policy be?

Well, as I mentioned, those who need https know how to enable it for Wikipedia. The reverse doesn't always work, since when https wikipedia fails to work behind a proxy, to many it just looks like Wikipedia is down ("Oh no! how will I ever complete my project now!").

So, while we shouldn't go actively editing https out, it's great if you try to use http in your Wikipedia links. And if you are editing a post, it's fine if you replace the https as well.

Note that this applies only for Wikipedia -- most sites do not have both HTTP and HTTPS at the same time, so editing a link to HTTP may break it (always check)

• Shouldn't it be: "... it's great if you try to use http in your Wikipedia links" – becko Apr 23 '13 at 15:31
• @becko: fixed, thanks :) – Manishearth Apr 23 '13 at 15:38
• "URLs are visible to men in the middle anyway" - Not quite. They see that you're connecting to en.wikipedia.org on port 443, but everything else is encrypted—even the URI and the headers. – nyuszika7h Dec 22 '14 at 12:37

This is probably a useless plug since most of Physics.SE's users do not come from China, but in China the government packet-filters all unencrypted overseas links, doing slow string-searching on them for keywords and RSTing the connection when sensitive stuff is detected. Obviously this big string-searching is the huge bottleneck on all the Chinese network gateways. HTTPS Wikipedia is far faster for me in China than the HTTP version, and won't suddenly get its connection dropped by a firewall due to some obscure thing mistaken for an anti-government word.