Hopefully the argument about back/forth traffic in SSL will soon be obsolete if Zero-RTT handshakes are implemented in TLS1.3. Surely this would then be comparable to standard HTTP requests?
SSL considered bloated
11–20 of 60 posts
Re: SSL considered bloated
#12Considered by you ... And you explanation is not that convincing.
Re: SSL considered bloated
#13The problem with this argument is that there are very high-security pages on the Internet --- things that protect people's bank accounts or most sensitive personal information --- and they're not going away. The junction, at the protocol level, between insecure web sites and secure ones is a major design weakness; we would have fewer attack vectors in the long run if we could count on uniform encryption across the web.
Re: SSL considered bloated
#14Hopefully the argument about back/forth traffic in SSL will soon be obsolete if Zero-RTT handshakes are implemented in TLS1.3. Surely this would then be comparable to standard HTTP requests?
Zero-RTT addresses latency, but not "bloat"; the same amount of data is exchanged, but application data can piggyback on the handshake messages.
Re: SSL considered bloated
#15The problem with this argument is that there are very high-security pages on the Internet --- things that protect people's bank accounts or most sensitive personal information --- and they're not going away. The junction, at the protocol level, between insecure web sites and secure ones is a major design weakness; we would have fewer attack vectors in the long run if we could count on uniform encryption across the we…
This is precisely my thought on SSL. I'm no expert (correct me if I'm wrong), but if I understand the technology correctly: if your http website connects to an https login page, who is to stop someone from spoofing a link to a fake login page on the http website.
Re: SSL considered bloated
#16SSL/TLS is bloated but that's not a reason not to use it.
Rather it's a reason we need some TLSv2 that just removes the crap and focuses only on three encryption/authentication modes:
* Desktop: High throughput, lots of CPU, minimal latency * IoT: small throughput, very little CPU, latency acceptable * Mobile: small to medium throughput, some CPU, minimize latency
A lot of bloated protocols are still good, they're bloated because backwards compatibility and everyone and their kitchensink needs to be able to decode it.
Re: SSL considered bloated
#17"I think [SSL on all websites] is motivated by: ... A desire to make traffic shaping and censorship more difficult."
Eh?
Re: SSL considered bloated
#18I really hope I'm not the only person who mentally groans whenever I see yet another "X considered Y" clickbait title. It's the tech equivalent of "this one weird trick" or "X Happened And You Won't Believe What Happened Next".
Re: SSL considered bloated
#19The problem with this argument is that there are very high-security pages on the Internet --- things that protect people's bank accounts or most sensitive personal information --- and they're not going away. The junction, at the protocol level, between insecure web sites and secure ones is a major design weakness; we would have fewer attack vectors in the long run if we could count on uniform encryption across the we…
This is precisely my thought on SSL. I'm no expert (correct me if I'm wrong), but if I understand the technology correctly: if your http website connects to an https login page, who is to stop someone from spoofing a link to a fake login page on the http website.
EV certificates help.
Re: SSL considered bloated
#20> Seems to me a bit like equipping everyone with armour to make shooting them more difficult. Solving the problem the wrong way? I don't know, making humans immune to bullets would be an elegant solution to the gun control debate which doesn't involve disagreements over the second amendment, and would make everyone win.
Body armor proponents unite! http://i.imgur.com/AubwoDf.png
