Automatic HTTPS Enforcement for New Executive Branch .gov Domains

This is fantastic news.<p>It wasn&#x27;t that long ago that I tried to log into a government site via my SSN, and discovered that the page didn&#x27;t even <i>permit</i> HTTPS. I was displeased, to say the least; logging in wasn&#x27;t exactly optional, so it seemed much worse than a business offering poor security.<p>Permitting HTTPS is obviously the first step, but security shouldn&#x27;t be limited to people with the expertise to seek it out. I&#x27;m really glad to see that something as inescapable as the .gov domain will be pursuing security-by-default.

Co-author of the post here, happy to answer questions. =)<p>This is a GSA initiative, not an 18F initiative. But 18F has a recent post detailing executive branch progress on HTTPS that may also be relevant:<p><a href="https:&#x2F;&#x2F;18f.gsa.gov&#x2F;2017&#x2F;01&#x2F;04&#x2F;tracking-the-us-governments-progress-on-moving-https&#x2F;" rel="nofollow">https:&#x2F;&#x2F;18f.gsa.gov&#x2F;2017&#x2F;01&#x2F;04&#x2F;tracking-the-us-governments-p...</a>

If anyone works in the Canadian government and wants my input in getting the political support to make this happen in your department, I&#x27;ve been helping some departments understand the nature of the risks (some are even paying me as a consultant!) of MITM attacks. It&#x27;s taking time, but I&#x27;m slowly seeing improvement. I can give you some tips as to how to properly communicate the importance of some of these and other measures (like getting monitors like Appcanary installed to watch for security vulnerabilities).<p>My email is in my profile :)

As a practical question: what is the expected capacity of the preload stores of browsers? Hundreds of thousands, millions or much more domains? Because at some point it seems like everyone with moderately high security requirements may want to have their certificates pinned &#x2F; preloaded.

I said something similar in a reply below, but I find it interesting that this amounts to a .Gov-wide decision that availability is always less important than confidentiality and integrity.<p>While that&#x27;s probably valid in the main, is that always true? FEMA&#x2F;NOAA spring to mind. As does IRS guidance, especially since those documents should have digital signatures themselves for an additional layer of integrity.<p>Was this idea part of the discussion?

From what I gather, Let&#x27;s Encrypt meets the guidelines to be considered acceptable, but is not really mentioned anywhere, neither in the linked page nor on https.cio.giv - is there any feeling one way or the other on the use of Let&#x27;s Encrypt for .gov?<p>Certainly one of the biggest headaches of the classic approach is forgetting to renew your certificate on time, a situation which Let&#x27;s Encrypt effectively avoids.

Unable to click through certificate warnings = completely inaccessible when there is an issue with certificate validation. Look at the shiny new attack surface!

What are the odds that the private keys for all of the .gov domains are also sent to the NSA? I guess if you are worried about another nation spying on your traffic you would be fine. I would expect that <i>all</i> of this traffic is decryptable by NSA though.

It should really be .gov.us rather than a top level domain.

How has this been enforced? and what about sub-domains?