Tim Berners-Lee has an article titled 'Web Security - "HTTPS Everywhere" harmful'[1]. He argues not that encryption is bad (as the title might ambiguously suggest), but that the use of a different URI prefix (http vs https) is harmful because it requires use of that prefix to ensure encryption and authentication is used. Rather, the HTTP prefix should be used for encryption, and upgraded in real-time by the client.
> A proposal then is to do HTTPS everywhere in the sense of the protocol but not the URI prefix. A browser gives the secure-looking user interface message, such as displaying the server certificate holder name above the document, only when the document has been fetched in an authenticated over an encrypted channel. This can be done by upgrading the HTTP to include TLS in real time, or in future cases by just trying encrypted version first.
He also states
> It is the user's task to ensure that their interactions are secure.
meaning, users are trained to look for the 's' but browsers are hiding the URI prefix, making this difficult.
> A proposal then is to do HTTPS everywhere in the sense of the protocol but not the URI prefix. A browser gives the secure-looking user interface message, such as displaying the server certificate holder name above the document, only when the document has been fetched in an authenticated over an encrypted channel. This can be done by upgrading the HTTP to include TLS in real time, or in future cases by just trying encrypted version first.
He also states
> It is the user's task to ensure that their interactions are secure.
meaning, users are trained to look for the 's' but browsers are hiding the URI prefix, making this difficult.
[1] https://www.w3.org/DesignIssues/Security-NotTheS.html