Nonsense. You probably got that from the Google Chrome browser.
Google makes money from their advertizers, and some of their advertizers
make money selling certificates for website encryption. Follow the money.
Does encryption make a website "safe"? That depends on what you are trying to do. The function and purpose of encryption is to hide things, so if the purpose of your website is to hide things from the public, encryption is a way to do that. A better way to do that is to not put it on the internet. Nothing is really safe on the internet, not even if it is encrypted (see "Layered Insecurity"). My website has nothing to hide, so encryption, which prevents legitimate users from legitimate access to public information, is counter-productive.
Some "experts" might tell you that encryption protects information from corruption, but it's not true. The easy way to corrupt data on a website is to change it on the server's hard drives. Good Guys and Bad Guys alike know how to do that, and it happens before any encryption, so the encryption (if any) only protects the already corrupted data. Theoretically it is possible to intercept the good data in transit and substitute corrupt data, but to do that requires physical access to the cable somewhere along the line. It could happen on the server premises, but anybody with access there can corrupt the data on the hard drives much more easily. It's not going to happen on the telephone poles -- and even less likely in underground cables -- because you need power and a bulky computer and hard-to-attach cable connectors to do the dastardly deed. It might happen on your own premises, where the internet enters your office or home, but you (or the security guys in your office building) would notice the villains. Most internet service providers do their own encryption (to prevent freeloaders) so there are not many places where you could actually do that. Or it could happen by a virus inside your own computer, but again, that's outside the coverage offered by encryption.
If a website is offering secret data to a few people with passwords, Bad Guys on the same local network -- perhaps in a vacant office in the same office building, or on an unencrypted WAN -- could watch the data go by (they cannot alter it, but they can look), and learn the secrets if it's not encrypted. But like I said, my website is public information, I have nothing to hide, so encryption offers no benefits and considerable downside.
Mostly Bad Guys are the ones with things to hide. Maybe that's why some people are pushing encryption: If only secrets are encrypted, then the cops and robbers know who to spend their efforts on to expose those secrets, but if everything is encrypted, they can't tell the secrets from the public information. I have no desire to help Bad Guys do Bad Things, so I believe an unencrypted internet is in the public interest. Other people may have other opinions, but they are wrong ;-)
See also my blog post three years ago "Secure Websites"
Tom Pittman
2017 April 26, Rev. 21 May 29
Response to "Let's Encrypt" (Internet Security Research Group):
1. we believe that all websites should use HTTPS for these reasons:
Plain HTTP traffic can be viewed in transitI answered this above. It's a non-issue.This is an obvious privacy issue, akin to mailing letters back and forth without an envelope.
Mailing letters back and forth without an envelope is called "postcards" and there are good and valid reasons to do that, including cost. "Let's Encrypt" offers you "a free, automated, and open Certificate Authority" but it doesn't work on old computers.
It is reported of Marie Antoinette that when she was told "the people have no bread," her reply was "Let them eat cake." She lost her head over that answer, and the nameless people behind "Let's Encrypt" who say "let them buy a new computer" might be deserving the same end. Some old computers are easier to use than new ones -- which are all unix or eunuchs-wannabes, and as everybody knows, eunuchs are people who are missing a vital organ so they cannot perform. The operating system is well named.
Besides, new computers cost more money than buying cake, and all new
computers are made in a single country with an oppressive regime, and many
electrical products made in that country have embedded spyware and time
bombs. It costs too much to ferret these malware out. It's better to boycott
all products made in China.
2. nothing they can do to prevent visitors from accidentally sending sensitive information as part of a request, perhaps via a form or a client software misconfiguration. Expecting them to never do that is an unreasonably high expectation.You cannot accidentally send sensitive information to a website that does not accept that kind of input. My website is smart enough to do that.
3. Finally, sometimes the very act of visiting a website can be sensitive information, especially for people living under oppressive regimes... Encrypted Client Hello (ECH)Oppressive regimes can (and probably do) block ECH access, just like they block undesirable websites that don't use it. Unencrypted websites solves a very real problem in countries without oppressive regimes, which is most of the world. If you want to do something to annoy minority governments, use HTTPS and annoy a different class of people (not governments), like me. HTTPS blocks my access every bit as effectively as the Bad Guys in China blocks access to other websites. HTTPS is part of the problem, not the solution.
Tom Pittman, 2026 July 1