HTTPS Adoption in the Longtail Ariana Mirian Christopher Thompson Stefan Savage University of California, San Diego Google University of California, San Diego
[email protected] [email protected] [email protected] Geoffrey M. Voelker Adrienne Porter Felt University of California, San Diego Google
[email protected] [email protected] ABSTRACT a certificate authority (CA) to acquire a certificate, and, finally, de- HTTPS is widely acknowledged as a pillar of modern web security. velop the skill to configure the server appropriately. Operators using However, while much attention focuses on the value delivered by third-party hosting must further contend with the technology and protocol improvements, the benefit of these advances is gated by the business choices made by their service providers, and interactions breadth of their adoption. Thus, while the majority of web pages with third-party advertisers and web search engines similarly can visited benefit from the confidentiality and integrity guarantees of create additional complications. HTTPS, this is contradictorily due to a minority of popular sites The most popular web sites have been the quickest to adopt currently supporting the protocol. In this paper written in April 2018, HTTPS. When scanning the 10,000 most popular sites (as ranked by we explore factors of HTTPS adoption on web sites more broadly. Alexa) in August of 2017, over 60% provided HTTPS connectivity. We analyze attributes of the Alexa top one million sites in August These popular sites have a number of natural advantages, such as 2017 and categorize them into popular and “longtail” sites, in an dedicated IT staff naturally funded by the advertising or e-commerce effort to identify points of leverage which offer promise for driving revenue that accrues with online popularity.