Adoption of HTTPS protocol on government serviceÂ websites
Tags: security, privacy, digitalindia, https
Published: 2017-04-19 22:47:15

---
title: "Adoption of HTTPS protocol on government serviceÂ websites"
published: true
description: Adoption of HTTPS protocol on government serviceÂ websites
tags: Security,Privacy,Digital India,HTTPS
canonical_url: https://medium.com/@konarkmodi/adoption-of-https-protocol-on-government-service-websites-542d308bd956
cover_image: https://thepracticaldev.s3.amazonaws.com/i/eyyt6ehn3n12nv90zzwg.png
---

Last week, Freedom of the Press Foundation announced the project [“secure the news ](https://securethe.news/) which tracks the adoption of HTTPS on news websites.
Inspired by it, we decided to do an analysis on[ Government of India digital services](https://services.india.gov.in/) and track the adoption of HTTPS across them.
[Digital India](http://digitalindia.gov.in/content/about-programme) is a campaign launched by the [Government of India](https://en.wikipedia.org/wiki/Government_of_India) to ensure that Government services are made available to citizens electronically by improving online infrastructure and by increasing Internet connectivity or by making the country digitally empowered in the field of technology.
Launched on 1 July 2015 by [Prime Minister](https://en.wikipedia.org/wiki/Prime_Minister_of_India) [Narendra Modi](https://en.wikipedia.org/wiki/Prime_Minister_of_India), the initiative spans across three core components:
The creation of digital infrastructure
Delivery of services digitally
[Digital literacy](https://en.wikipedia.org/wiki/Digital_literacy)

The Digital India programme has, as of date, a total 1995 [services](https://services.india.gov.in/category/listing?ln=en) listed on their website, categorised as below:

![alt text](https://cdn-images-1.medium.com/max/1600/1*kpFPprKFjIMYgXUOeg0K9g.png "Service Categories")
![alt text](https://cdn-images-1.medium.com/max/1600/1*BTMikNH-OgX5ENwtKPJkoA.png "Breakup of 874 domains acrossÂ services")

While some of the services are more information centric with respect to policy updates, etc, there are a few websites that deal with user information on everyday basis, ex: [Air India](), [passport services](), Income and Taxation services, Citizenship and Visas, [Online hospital appointments]() etc.

From the list of services, we analysed 874 valid domains for adoption of HTTPS protocol. Our findings are:
#### a. 31% have a validÂ HTTPS
#### b. Only 7.4% default toÂ HTTPS
#### c. Less then 1.5% have [HSTS]()Â enabled
#### d. Merely 2 sites are on the [HSTS preloaded list]()

![alt text](https://cdn-images-1.medium.com/max/1600/1*W3P-IpdP5nch4hPOMDrpbA.png "HTTPS adoption across service categories")

## What does this mean?

While this is a great first step for the government towards bringing in transparency and accountability by going digital, the next steps ought to be towards privacy & security of user information and data protection. Actively adopting security measures will definitely result in lesser vulnerability of data thefts/ hacks or other cyber threats that present itself in friendly or unfriendly environment. The primary, and also the simplest, step towards data protection and privacy is adopting HTTPS protocol.

## Prologue on HTTPS or why is it importantÂ ?
HTTPS connection is easily recognised by the most novice of Internet users for the lock icon it displays in your web browser’s address bar (the “S in HTTPS means “secure”).

It signifies that the connection between you and the website you are reading is encrypted, so someone spying on your internet connectionâ€Š–â€Šwhether a criminal trying to eavesdrop on you through public WiFi or a government that has access to raw Internet trafficâ€Š–â€Šcannot see the information that you are transmitting.

A regular HTTP connection means that such attackers can potentially see the search terms or articles you are reading, spy on your username and password, or spoof a website to steal your personal information. Unencrypted HTTP traffic is also easier to filter and block, allowing for selective censorship of articles, subjects, specific reporters or outlets by authoritarian governments.

+ Protects user’s sensitive information.
+ Protects integrity of your website.
+ It is the future of the web.
+ [10 good reasons to switch to HTTPS](https://securethe.news/why/)

## Rise of HSTS

HSTS(HTTP Strict Transport Security), is a relatively new standard that aims to bolster the strength of HTTPS connections.

When a web server implements and enables HSTS, all browsers that connect to it will be forced to do so strictly via HTTPS. That means, there won’t be that exploitable vulnerability wherein a browser would initially connect via HTTP before it gets redirected to HTTPSâ€Š–â€Šexcept for that very first instance that the browser makes contact with the web server.

Major benefits of having a site on HSTS are the following:

..* Defence against sslstrip-like attacks. The initial navigation to somewebsite.com is automatically upgraded to HTTPS

..* Zero tolerance for certification problems. The user is not permitted to “click through anything such as a self-signed cert.

If you have a site wide implementation of SSL, as an additional layer of security, the website owners could also apply for [HSTS Preloading](https://hstspreload.org/). A detailed explanation on why HSTS preloading matters specially for sites dealing with sensitive user data can be found [here](https://www.troyhunt.com/understanding-http-strict-transport/).

## Resources and tips for deploying HTTPS by default
List of recommended resources to help you understand HTTPS and how to go about deploying it:
+ [Federal government adoption of HTTPS](https://pulse.cio.gov/)
+ EFFâ€Š–â€Š[How to deploy HTTPS correctly](https://www.eff.org/https-everywhere/deploying-https)
+ Mozillaâ€Š–â€Š[Security/Guidelines/Web Security](https://wiki.mozilla.org/Security/Guidelines/Web_Security)
+ Ivan Ristic’s [Bulletproof SSL and TLS](https://www.feistyduck.com/books/bulletproof-ssl-and-tls/)
+ Google Developer’s Blogâ€Š–â€Š[Enabling HTTPS on Your Servers](https://developers.google.com/web/fundamentals/security/encrypt-in-transit/enable-https)
+ [Let’s Encrypt]()

## Next steps and To-do’s
+ This blog post is certainly the first step.
+ We are currently working on making it a formal project, with automation to verify the adoption of HTTPS.
+ Make all the codebase + data open and put it on Github.
+ Create a more comprehensive list, based on services that the websites offer.
+ Expand to other countries government services as well.
+ Contribute rulesets to [HTTPS Everywhere extension](https://www.eff.org/https-everywhere).

## Team
[Bibhas](https://twitter.com/bibhasdn), [Pallavi](https://twitter.com/Pi_Modi), [Konark](https://twitter.com/konarkmodi)