Strengthening HTTP: A Personal View
1–10 of 51 posts
Re: Strengthening HTTP: A Personal View
#2Very much agree, HTTP2 ftw.11.11
Re: Strengthening HTTP: A Personal View
#3Myself, I like the idea of opportunistic encryption. Why not require TLS for HTTP/2 but don't require authentication for http:// URLs?
Re: Strengthening HTTP: A Personal View
#4There goes HTTP2's most exciting feature. I guess IETF will remain as useless as ever. Strong encryption on the Internet will need to arrive organically from certain projects catching momentum, and then Internet stakeholders can adopt them as they are, or risk being left behind. IETF standards will always have a multitude of compromises to please all the top Internet stakeholders (even if that's detrimental to the Internet ecosystem and its security).
Also are those 1 or 2 (from what we know of) NSA employees still shaping crypto policy at IETF?
Re: Strengthening HTTP: A Personal View
#5I hate this new HTTP.
They seem to have taken a beautifully simple concept and added so much complexity it's ugly and horrible and awful.
Re: Strengthening HTTP: A Personal View
#6I hate this new HTTP. They seem to have taken a beautifully simple concept and added so much complexity it's ugly and horrible and awful.
I hear this a lot, but without a consistent argument as to why that's the case. Do you have anything more than that to offer?
HTTP 1.1 is relatively simple, but it's also a bottleneck.
Re: Strengthening HTTP: A Personal View
#7Myself, I like the idea of opportunistic encryption. Why not require TLS for HTTP/2 but don't require authentication for http:// URLs?
It's hard to see what benefit that would offer. Non-authenticated TLS is trivially vulnerable to MITM attacks. This is especially the case because I can't foresee a situation in which a website would put the effort in to implement opportunistic TLS, but not implement straightforward authenticated HTTPS…
Re: Strengthening HTTP: A Personal View
#8It's disappointing to hear that the idea of requiring TLS with HTTP/2 has lost traction. For me, TLS-everywhere was the carrot on the stick.
I recognize that getting consensus is hard work, but I don't think creating another encryption-optional protocol and letting vendors duke it over security is going to end well for the users.
HTTP is a deployed protocol with lots of existing
stakeholders, like proxy vendors, network operators,
corporate firewalls and so on. Requiring encryption
with HTTP/2 means that these stakeholders get
disenfranchised.
Re: Strengthening HTTP: A Personal View
#9It's disappointing to hear that the idea of requiring TLS with HTTP/2 has lost traction. For me, TLS-everywhere was the carrot on the stick. I recognize that getting consensus is hard work, but I don't think creating another encryption-optional protocol and letting vendors duke it over security is going to end well for the users. HTTP is a deployed protocol with lots of existing stakeholders, like proxy vendors, netw…
One obvious change here is that it would make CA-signed certificates mandatory for all HTTP2 web servers - is that really a situation we want?
Re: Strengthening HTTP: A Personal View
#10Myself, I like the idea of opportunistic encryption. Why not require TLS for HTTP/2 but don't require authentication for http:// URLs?
It's hard to see what benefit that would offer. Non-authenticated TLS is trivially vulnerable to MITM attacks. This is especially the case because I can't foresee a situation in which a website would put the effort in to implement opportunistic TLS, but not implement straightforward authenticated HTTPS…
It completely prevents passive surveillance, however. Sure, you can MITM, but the point is now to look at anything you have to do an MITM attack, unlike now, where most traffic is unencrypted and you can do surveillance passively. This makes surveillance more difficult. Net gain for everyone.