Progress Towards 100% HTTPS, June 2016
I see this as security theater.  Most web pages don&#x27;t need to be encrypted.  Anything with a form should be, but if you&#x27;re just viewing static content, there&#x27;s little point. Yes, it obscures what content you&#x27;re viewing, slightly.  An observer often could figure that out from the file length.<p>Encrypting everything increases the demand for low-rent SSL certs. Anything below OV (Organization Validated) is junk, and if money is involved, an EV (Extended Validation) cert should be used. Trying to encrypt everything leads to messes such as Cloudflare&#x27;s MITM certs which name hundreds of unrelated domains. This is a step backwards.