I use HTTPS Everywhere in Firefox, but it only enforces HTTPS for a very limited set of very well-known sites (by default).
I use a wide variety of much smaller sites which do have HTTPS versions, but when going to HTTP they don't automatically enforce their HTTPS (let alone have HSTS), so unless I specifically remember to type in HTTPS (and/or add all their domains to the whitelist in HTTPS Everywhere), I am time and time again using non-secure versions of websites that I easily could be automatically using the secure version thanks to some ingenius Firefox add-on or userscript.
It may introduce a slight usability handicap, but I would like to try out the concept for the sake of potentially much, much greater privacy from wiretapping snoopers listening in on the Internet. (such as my VPN, my ISP, or other nefarious parties like NSA.)
It could even just be a very simple Greasemonkey script. I would imagine it would go:
- Force every page to change
httpsin the URL, if not already
httpspage loads normally with standard HTTP response, do nothing (mission accomplished).
httpspage fails to load, revert back to
httpand add domain as an
@excludeentry in the script (or another elegant way of making a 'blacklist' in the script) so an attempt isn't made again.
I would not know how to code that though.
As an awesome bonus, it could introduce a button / notification that says 'Boo, this site doesn't exist in HTTPS!' to remind me when I'm currently on an 'insecure' site so that maybe I can start using those sites less and stick to the ones that I know can't be snooped on as near as much, instead.
And BTW, as for (bad) certificate (trust) issues: I'd rather still automatically use a cert a site uses, and do a second step of verification if I'm going to actually log into it, rather than automatically going to NON secure version of countless lazily-configured sites without realising it.