HTTPS does not protect against MiM attacks.

Experts from the Trustworthy Internet Movement (TIM) have found that 90% of websites using the HTTPS protocol are vulnerable.

For the study, the company's specialists analyzed nearly 200,000 of the largest websites that support the HTTPS protocol.

The company analyzed which protocols HTTPS websites support (SSL 2.0, SSL 3.0, TLS 1.0, TLS 1.1, etc.), the length of the key used to secure communication (512 bits, 1024 bits, 2048 bits, etc.), and the size of the supported code (256 bits, 128 bits, or lower).

The study found that half of Alexa-ranked websites that support the secure HTTPS protocol use a combination of security measures, such as the new version of the HTTPS protocol, strong encryption, and long keys. However, only 10% of these are truly secure.

The study also found that more than 13% of the most popular HTTPS-enabled websites allowed redirects over insecure connections.