TLScompare: Crowdsourcing Rules for HTTPS Everywhere

For billions of users, today’s Internet has become a critical infrastructure for information retrieval, social interaction and online commerce. However, in recent years research has shown that mechanisms to increase security and privacy like HTTPS are seldomly employed by default. With the exception of some notable key players like Google or Facebook, the transition to protecting not only sensitive information flows but all communication content using TLS is still in the early stages. While non-significant portion of the web can be reached securely using an open-source browser extension called HTTPS Everywhere by the EFF, the rules fueling it are so far manually created and maintained by a small set of people. In this paper we present our findings in creating and validating rules for HTTPS Everywhere using crowdsourcing approaches. We created a publicly reachable platform at tlscompare.org to validate new as well as existing rules at large scale. Over a period of approximately 5 months we obtained results for more than 7,500 websites, using multiple seeding approaches. In total, the users of TLScompare spent more than 28 hours of comparing time to validate existing and new rules for HTTPS Everywhere. One of our key findings is that users tend to disagree even regarding binary decisions like whether two websites are similar over port 80 and 443.