Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Strengthening HTTP: A Personal View

mnot.net

Post reply on HN
Print view View original

11–20 of 51 posts

Re: Strengthening HTTP: A Personal View

#11

Post by quicksilfer »

matthewmacleod wrote: post #9
rx4g wrote: post #8

It's disappointing to hear that the idea of requiring TLS with HTTP/2 has lost traction. For me, TLS-everywhere was the carrot on the stick. I recognize that getting consensus is hard work, but I don't think creating another encryption-optional protocol and letting vendors duke it over security is going to end well for the users. HTTP is a deployed protocol with lots of existing stakeholders, like proxy vendors, netw…

One obvious change here is that it would make CA-signed certificates mandatory for all HTTP2 web servers - is that really a situation we want?

That doesn't have to be the case. You could still allow self-signage, with all of the security caveats that presents.

Who knows. Maybe that arrangement could even spur a sorely needed push for a free certificate trust network and get rid of CA's entirely.

Re: Strengthening HTTP: A Personal View

#12

Post by jessaustin »

matthewmacleod wrote: post #7
TazeTSchnitzel wrote: post #3

Myself, I like the idea of opportunistic encryption. Why not require TLS for HTTP/2 but don't require authentication for http:// URLs?

It's hard to see what benefit that would offer. Non-authenticated TLS is trivially vulnerable to MITM attacks. This is especially the case because I can't foresee a situation in which a website would put the effort in to implement opportunistic TLS, but not implement straightforward authenticated HTTPS…

Non-authenticated TLS is trivially vulnerable to MITM attacks.

I don't think a well-implemented TOFU/POP policy would be "trivially vulnerable", but it would still accommodate self-signing. Standardizing this would have been a worthy goal for IETF.

Re: Strengthening HTTP: A Personal View

#13

Post by Ono-Sendai »

matthewmacleod wrote: post #6
jbb555 wrote: post #5

I hate this new HTTP. They seem to have taken a beautifully simple concept and added so much complexity it's ugly and horrible and awful.

I hear this a lot, but without a consistent argument as to why that's the case. Do you have anything more than that to offer? HTTP 1.1 is relatively simple, but it's also a bottleneck.

Are you claiming HTTP2 is not more complicated than HTTP 1.1?

Re: Strengthening HTTP: A Personal View

#14

Post by quicksilfer »

rx4g wrote: post #8

It's disappointing to hear that the idea of requiring TLS with HTTP/2 has lost traction. For me, TLS-everywhere was the carrot on the stick. I recognize that getting consensus is hard work, but I don't think creating another encryption-optional protocol and letting vendors duke it over security is going to end well for the users. HTTP is a deployed protocol with lots of existing stakeholders, like proxy vendors, netw…

I'd like to hear why maintaining status quo for stakeholders should ever be a valid argument for a technology standard.

Re: Strengthening HTTP: A Personal View

#15

Post by TazeTSchnitzel »

jessaustin wrote: post #12
matthewmacleod wrote: post #7

Earlier quoted context omitted.

It's hard to see what benefit that would offer. Non-authenticated TLS is trivially vulnerable to MITM attacks. This is especially the case because I can't foresee a situation in which a website would put the effort in to implement opportunistic TLS, but not implement straightforward authenticated HTTPS…

Non-authenticated TLS is trivially vulnerable to MITM attacks. I don't think a well-implemented TOFU/POP policy would be "trivially vulnerable", but it would still accommodate self-signing. Standardizing this would have been a worthy goal for IETF.

I'd argue that even if it is MITM-vulnerable, it's still very useful, as it makes passive surveillance impossible.

Re: Strengthening HTTP: A Personal View

#16

Post by protonfish »

matthewmacleod wrote: post #6
jbb555 wrote: post #5

I hate this new HTTP. They seem to have taken a beautifully simple concept and added so much complexity it's ugly and horrible and awful.

I hear this a lot, but without a consistent argument as to why that's the case. Do you have anything more than that to offer? HTTP 1.1 is relatively simple, but it's also a bottleneck.

Don't shift the burden of proof-It is up to HTTP/2 proponents to demonstrate that the benefits are greater than the costs and from everything I've seen the benefits are meager and the costs are large.

Re: Strengthening HTTP: A Personal View

#17

Post by jessaustin »

For example, in the current design of HTTP the decision as to whether to use encryption is completely up to the server; the only thing the user can do is observe whether a URL is “HTTP” or “HTTPS” (or maybe watch a lock icon) and decide whether they can continue surfing.

This seems a strange characterization. As in any other network protocol, if the client and server don't agree then nothing happens. If either insists on something the other finds unacceptable (e.g. a 404 response to "GET /your-secret-plans HTTP/1.1") then the transaction doesn't take place. Perhaps this could be made more explicit via a header, but what would that really gain?

Re: Strengthening HTTP: A Personal View

#18

Post by matthewmacleod »

Ono-Sendai wrote: post #13
matthewmacleod wrote: post #6

Earlier quoted context omitted.

I hear this a lot, but without a consistent argument as to why that's the case. Do you have anything more than that to offer? HTTP 1.1 is relatively simple, but it's also a bottleneck.

Are you claiming HTTP2 is not more complicated than HTTP 1.1?

Is is more complex - why is that inherently a bad thing?

Re: Strengthening HTTP: A Personal View

#19

Post by matthewmacleod »

protonfish wrote: post #16
matthewmacleod wrote: post #6

Earlier quoted context omitted.

I hear this a lot, but without a consistent argument as to why that's the case. Do you have anything more than that to offer? HTTP 1.1 is relatively simple, but it's also a bottleneck.

Don't shift the burden of proof-It is up to HTTP/2 proponents to demonstrate that the benefits are greater than the costs and from everything I've seen the benefits are meager and the costs are large.

I'm not trying to shift the burden here, but the point made was along the lines of "HTTP2 is rubbish" - I've seen this a lot, with little to back it up.

But I'd say some of the benefits were:

- Server push support - Multiplexed requests/header compression/other performance improvements - Mandatory encryption support

Downsides are (from what I understand):

- Not a plaintext protocol

There may be more downsides, which I'm happy to hear about.

Re: Strengthening HTTP: A Personal View

#20

Post by Ono-Sendai »

matthewmacleod wrote: post #18
Ono-Sendai wrote: post #13

Earlier quoted context omitted.

Are you claiming HTTP2 is not more complicated than HTTP 1.1?

Is is more complex - why is that inherently a bad thing?

Complexity is bad, all other things being equal, because it takes longer to implement, is more likely to contain bugs, etc..
Post reply on HN