US CIO Orders All .Gov Websites To Require Encrypted Connections, Amazon Enters The Secure Cert Space

from the moving-forward dept

As top FBI officials are arguing that the tech industry needs to “prevent encryption,” the federal government’s CIO, Tony Scott, has officially announced that all federal government websites will only be available via encrypted HTTPS connections by the end of next year. As we noted, this was proposed back in March, but after an open comment period (via Github!), the policy is now official. The official memo talks about the importance of encryption:

The unencrypted HTTP protocol does not protect data from interception or alteration, which can subject users to eavesdropping, tracking, and the modification of received data. The majority of Federal websites use HTTP as the as primary protocol to communicate over the public internet. Unencrypted HTTP connections create a privacy vulnerability and expose potentially sensitive information about users of unencrypted Federal websites and services. Data sent over HTTP is susceptible to interception, manipulation, and impersonation. This data can include browser identity, website content, search terms, and other user-submitted information.

To address these concerns, many commercial organizations have adopted HTTPS or implemented HTTPS-only policies to protect visitors to their websites and services. Users of Federal websites and services deserve the same protection. Private and secure connections are becoming the Internet’s baseline, as expressed by the policies of the Internet’s standards bodies, popular web browsers, and the Internet community of practice. The Federal government must adapt to this changing landscape, and benefits by beginning the conversion now. Proactive investment at the Federal level will support faster internet-wide adoption and promote better privacy standards for the entire browsing public.

And the memo doesn’t mince words about websites that choose not to go to HTTPS-only:

Federal websites that do not convert to HTTPS will not keep pace with privacy and security practices used by commercial organizations, and with current and upcoming Internet standards. This leaves Americans vulnerable to known threats, and may reduce their confidence in their government. Although some Federal websites currently use HTTPS, there has not been a consistent policy in this area. An HTTPS-only mandate will provide the public with a consistent, private browsing experience and position the Federal Government as a leader in Internet security.

It’s good to see the federal government embracing this. The plan is to have all federal government websites fully HTTPS by the end of 2016.

Separately, another big step in the world of HTTPS happened quietly on Monday as well: Amazon started offering secure certificates as well, and it appears that they’re looking to make it much easier and convenient. Oh, and it is not just for customers registering their domains through Amazon either.

It’s good to see the internet world moving more and more to a place where all connections will be encrypted.

Filed Under: , , , , ,
Companies: amazon

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “US CIO Orders All .Gov Websites To Require Encrypted Connections, Amazon Enters The Secure Cert Space”

Subscribe: RSS Leave a comment
28 Comments
That One Guy (profile) says:

Refreshing honesty

Well, guess it’s official then, even the government is admitting that it’s run by terrorists and/or criminals, since clearly those are the only two groups that would use encryption, as the government itself constantly insists.

Sure they may claim it’s for security reasons, but given the government constantly brushes aside any similar claims when used by the public, clearly ‘security’ is not a valid justification, and it can only be criminal intent behind their push for widespread encryption.

Pixelation says:

Re: Refreshing honesty

“Well, guess it’s official then, even the government is admitting that it’s run by terrorists and/or criminals, since clearly those are the only two groups that would use encryption, as the government itself constantly insists. “

Or…They’ve found their way around encryption and are now happy to endorse it.

sigalrm (profile) says:

Re: Re: Re:

Yes, but do they have a root certificate openly tied to the US Government pre-installed in every major browser and operating system? https://www.irs.gov's ssl cert is issued by Akamai and fails to validate due to a hostname mismatch. https://www.whitehouse.gov is signed by Verizon/Akamai. https://www.cia.gov is signed by Symantec.

The US Government is big, and if they’re going to successfully implement this mandate, they’re going to need their own public root certificate authority to cost effectively sign all those new SSL Keys, and for the sake of simplicity, that root CA cert will need to be installed everywhere by default. Otherwise Grandpa is going to get a browser cert error when he goes to http://www.irs.gov, and we can’t have that.

Of course, once a root is installed, it can be used to sign certs for any web site.

Anonymous Anonymous Coward says:

More Encryptio

I wonder when or if they will also order the backend servers encrypted as well. Certainly all data stored (especially the password files, SSN numbers, home addresses, phone numbers, any other personally identifiable information).

Not sure if everything needs encrypting, some expert will tell me shortly.

Once this is accomplished, maybe we could convince all the payment services or other holders of personal information to do the same.

John Fenderson (profile) says:

Re: More Encryptio

“Not sure if everything needs encrypting, some expert will tell me shortly.”

It depends on the amount of security you want. Before anyone answers “all of it”, it must be acknowledged that increased security doesn’t come for free. It is paid for in terms of reduced convenience. So, “all of it” is not necessarily the right answer. It all depends.

That said, it’s much better to encrypt more than is needed than to encrypt less.

Anonymous Anonymous Coward says:

Re: Re: More Encryptio

So we will continue to be subject to the formula where the cost of PR to overcome gross embarrassment from leaked data must be greater than the cost of the encryption/decryption process, which is rarely calculated in a proactive manner.

Of course that also means that cost of the encryption/decryption process plus good PR from being proactive must be less than the quarterly profits sent to Wall Street unless the corporation (AKA person) actually has a conscience.

Either way, us poor suckers that have our data in non encrypted form on some companies (or government’s) servers are potentially screwed until some legislative body (congress) pushes the right buttons.

Violated (profile) says:

Amazon

I will add that Amazon sure need to make their popular shopping website HTTPS encrypted to give their users the fully secure shopping experience.

They seem to be making some progress but as can be seen here they have yet to get the right certificates installed… https://ecx.images-amazon.com/images/I/917G5gsQjgL._SL1500_.jpg

Other secure sites would also like to link to them but cannot link to insecure site.

Add Your Comment

Your email address will not be published.

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...
Loading...