Why No HTTPS?
Google is the major player pushing everyone to encrypt with HTTPS with other companies hopping on board.  They argued a populist viewpoint with what Snowden revelaled they need to protect the public, but the real reason they pushed HTTPS so hard has more to do with protecting their business and getting more metadata.<p>It&#x27;s no secret ISP&#x27;s are consolidating and being bought up by media conglomerates who want to secure the distribution method for their product and exclude competitors in a new market.  Those companies view the internet like they view cable TV; it exists to deploy entertainment and advertising to the public and to convert people into products for companies.  But they need a mechanism to figure out what is engaging, e.g. Nielsen Ratings.<p>There&#x27;s only one thing more accurate than the traditional web bug or javascript running on a webpage, and that&#x27;s actually MITMing the traffic and extracting the data raw.  If you own the ISP you can do this.  You can also inject ad&#x27;s.  Ad&#x27;s and Rating websites is something Google has built their business on.<p>I&#x27;m really sure they have a sour taste in their mouth left over from from google fiber due to the politics of ILECs trying to protect their literal state-granted monopoly.  And in all seriousness, with POTS being retired, the government is granting monopolies over last-mile wire to cable co&#x27;s.<p>So Google decided on the nuclear option: they&#x27;ve decided we&#x27;re just going to get everyone to encrypt their traffic and not just with easily SSLStrip able stuff.  We&#x27;re going to push the standards organizations to deploy SSL\TLS in a way nobody can crack it, then we&#x27;re going to provide resources like Lets Encrypt to make getting keys cheap, and then we&#x27;re going to be beligerant whenever the government complains about not being able to get at the traffic.<p>Now all the ISP&#x27;s can see are HTTPS connections to AWS, Azure and Google on their equipment; using IP&#x27;s to try to figure out what site is what doesn&#x27;t work.  They can still attempt to MITM the traffic and replace keys and impersonate key repo&#x27;s and I&#x27;m sure in a lot of cases they do, however, that opens them up to class action lawsuits and criminal hacking charges.  You don&#x27;t want a citizen organization charging your network architect with violating the wiretap act; Network Architects are hard enough to work with, give them a reason to tell their employer they are not going to commit a crime, and they&#x27;ll end up fighting their employers tooth and nail.  Both of which I&#x27;m sure Google would be more than happy to fund to protect its business.<p>The other advantage you get out of HTTPS is the session re-use feature.  When someone re-connects to your webpage, instead of establishing a new connection, they can re-use the session they had before; this reliably tags a device and allows you to identify connections from a device even when IP&#x27;s are changing, and would be more accurate than a browser fingerprint.  This is not a new technology or mechanism; IPSEC IKE sessions can last years.<p>In all candor, we&#x27;ve got military-grade encryption protecting general internet traffic at this point and everyone on this forum is going to argue about privacy without understanding where the market is at or why.  That speaks volumes to the times we live in and how effective astroturfing and misinformation campaigns are.