The websites of computer and technology companies and financial organisations showed a much higher level of adoption than shopping and gaming sites, for example.
“In the financial sector, almost every one of the sites we looked at had encrypted links”, Prof Woodward said, “but even in retail the adoption of the very latest standards is low.”
A quarter of the shopping sites studied were using Transport Layer Security (TLS), which offers tools including digital certificates, remote passwords, and a choice of ciphers to encrypt traffic between a website and its visitors.
But among news and sport websites fewer than 8% were found to be using the protocol.
Among those that did, many failed to make use of some of the strongest tools available, such as HSTS, which automatically pushes users accessing an unsecured version of a website on to the encrypted version instead.
‘Click on the padlock’
“It’s like news and sport content providers don’t value the security of their content,” Prof Woodward said.
“They’re leaving themselves vulnerable to attacks like cross-site scripting, where an attacker can pretend something’s come from a website when it hasn’t.”
But Prof Woodward warned against putting too much faith in sites that appear to have the most up-to-date and comprehensive security protocols in place.
“People assume that because they’re using TLS they’re having a secure conversation, but there’s no guarantee about who they’re having that secure conversation with,” he explained.
“Some of those spoof sites are using more up-to-date security than the genuine sites. You’ve got to click on that padlock and check who it is you’re talking to.”