Hacker News Reader

I bet the answer is HTTPS Everywhere. The only bad thing about it is the mixed content blocking, but I still think everyone should use it.

There was a link to schneier's blog here recently and a few people mentioned that his cert was expired. I am willing to be that everyone who saw the cert warning were httpseverywhere users.

https://www.eff.org/https-everywhere

I didn't post it, but I assume s/he was cutting and pasting from their URL bar, and they use HTTPS Everywhere or similar to encourage their browser to always prefer HTTPS connections (which xkcd provides, but to my ongoing annoyance, Amazon does not).

https://www.eff.org/https-everywhere

One could argue this should be a built-in option these days....

Unfortunately, xkcd (along with NYTimes and probably others) link to CSS/JS resources at http:// URLs, which defeats the security of HTTPS. The next version of Firefox will block mixed content in these cases, and being on the alpha channel, I've had to disable HTTPS Everywhere for these sites.

Perhaps he's using HTTPS Everywhere.