{"action":"opened","issue":{"url":"https://api.github.com/repos/GSA/data.gov/issues/587","labels_url":"https://api.github.com/repos/GSA/data.gov/issues/587/labels{/name}","comments_url":"https://api.github.com/repos/GSA/data.gov/issues/587/comments","events_url":"https://api.github.com/repos/GSA/data.gov/issues/587/events","html_url":"https://github.com/GSA/data.gov/issues/587","id":58206238,"number":587,"title":"make data.gov accessible via https only","user":{"login":"robertharm","id":158669,"avatar_url":"https://avatars.githubusercontent.com/u/158669?v=3","gravatar_id":"","url":"https://api.github.com/users/robertharm","html_url":"https://github.com/robertharm","followers_url":"https://api.github.com/users/robertharm/followers","following_url":"https://api.github.com/users/robertharm/following{/other_user}","gists_url":"https://api.github.com/users/robertharm/gists{/gist_id}","starred_url":"https://api.github.com/users/robertharm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/robertharm/subscriptions","organizations_url":"https://api.github.com/users/robertharm/orgs","repos_url":"https://api.github.com/users/robertharm/repos","events_url":"https://api.github.com/users/robertharm/events{/privacy}","received_events_url":"https://api.github.com/users/robertharm/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-02-19T13:12:19Z","updated_at":"2015-02-19T13:12:19Z","closed_at":null,"body":"data.gov is accessible via https only if users actively decide to use it. As TLS encryption not only secures sensitive data like user credentials but also ensures the authenticity and integrity of data transmitted and the sender (prevention of man-in-the-middle attacks as additional benefits amongst others) I wonder why data.gov hasnt yet made its website available via https only.\r\n\r\nNevertheless as ssllabs.com only assigns grade B (especially as RC4 cipher is still supported and forward secrecy not: https://www.ssllabs.com/ssltest/analyze.html?d=data.gov&s=172.230.231.192&latest) I would suggest to also follow the recommendations from the report. Technical guidelines which can help here can be found at https://bettercrypto.org "}}