what's open is not HTTPS