Hypertext Transfer Protocol Version 2 • Hacker News Board

Re: Hypertext Transfer Protocol Version 2

#111

Post by wmf » Thu, Aug 07, 2014, 7:19 PM UTC

xorcist wrote: post #106

wmf wrote: post #101

Earlier quoted context omitted.

In HTTP terms a reverse proxy is just a Web server (what it does internally is its own business), not a proxy. HTTP/2 load balancers have no trouble terminating TLS.

If you disagree with PHK, you have to refute the details in his notes, not just wave them away. That they can be made to work does not mean there is not a problem.

PHK keeps calling for radical changes to HTTP semantics which other people don't have the stomach for and would take a decade to deploy even if they did. In some sense, getting HTTP/2 done quickly clears the field for people like PHK to start on HTTP/3 sooner.

Re: Hypertext Transfer Protocol Version 2

#112

Post by nitrogen » Sat, Aug 09, 2014, 6:51 AM UTC

kaoD wrote: post #99

nitrogen wrote: post #49

Earlier quoted context omitted.

Read my final paragraph. You don't have to care about MITM to benefit from opportunistic encryption.

> You don't have to care about MITM to benefit from opportunistic encryption. How? An encrypted connection subject to MITM is as secure as an non-encrypted one. Attackers will stop listening for plaintext credentials at WiFi spots and will just launch their favorite HTTPS MITM tool instead. Certificate pinning is flawed because you cannot revoke certificates from your clients. How would you distinguish a MITM attack…

MITM isn't the only threat to Internet users. I can see three levels of security, each of which provides more security for users but less convenience for server operators:

1. Opportunistic encryption without certificates or identity pinning -- protects against dragnet surveillance and packet sniffing, but not MITM.

2. Encryption with pinned self-signed certs -- protects against second connection MITM, but not stolen certs without some revocation design.

3. Encryption and identity verification with CA- or WoT-signed certs -- protects against first connection MITM except by powerful adversaries.

Re: Hypertext Transfer Protocol Version 2

#113

Post by xorcist » Tue, Aug 12, 2014, 6:17 PM UTC

wmf wrote: post #111

xorcist wrote: post #106

Earlier quoted context omitted.

If you disagree with PHK, you have to refute the details in his notes, not just wave them away. That they can be made to work does not mean there is not a problem.

PHK keeps calling for radical changes to HTTP semantics which other people don't have the stomach for and would take a decade to deploy even if they did. In some sense, getting HTTP/2 done quickly clears the field for people like PHK to start on HTTP/3 sooner.

Not entirely true. PHK outlines some specific issues with HTTP/2 that makes a load balancer's job harder and/or less performant.