No single component of HTTP is ill conceived, broken, or unwarranted. Yet, when we put it all together, many security and privacy features seem to cancel out, and the user is left quite exposed to eavesdroppers running rampant. Sadly, we can do little without starting over from scratch, and there is no guarantee that the results would work as well or provide even as much privacy as HTTP, HTML, and WWW clients do now.