3 ms·

I personally argued with the W3C TAG against an HTTPS-only web for this reason. Tim Berners Lee, who heads the TAG, ceremonially speaking, argued against it, to

I personally argued with the W3C TAG against an HTTPS-only web for this reason. Tim Berners Lee, who heads the TAG, ceremonially speaking, argued against it, too, but on different ground. The browser vendor 'experts' on the TAG totally dismissed any and all argument against forcing everyone to use HTTPS. They were basically told by their employers (the big browser vendors and CDNs like Akamai) to make it happen. HTTPS is a rather costly false sense of security. Now anyone who wants to setup a website, for whatever reason, has to go thru some central authority in the name of "securing the web" (LOL) but it's just another way to control free speech and what people do with the web.

mangeletti 11y ago
It's worth noting that Akamai is on the board of the parent organization of Let's Encrypt.
johncolanduoni 11y ago
> it's just another way to control free speech and what people do with the web How so? Do you expect browsers to stop serving content from sites using boring old HTTP? And the fact is that we've had to go through a central authority to put a website up for a long time, with DNS.
bandrami 11y ago
Thank you. Demanding TLS while insisting on keeping our broken PKI alive is saying that anonymous publishing is impossible. Just look at the stupid way browsers treat self-signed certificates: these are strictly better than plaintext, but plaintext gets no warning and self-signed certificates are warned about and in some cases actually blocked. Similarly, one mailer (exim, I think?) on seeing an untrusted certificate would actually downgrade to plaintext. There aren't enough palms or enough faces for that.
- icebraining 11y ago
  Just look at the stupid way browsers treat self-signed certificates: these are strictly better than plaintext, but plaintext gets no warning and self-signed certificates are warned about and in some cases actually blocked. Technically, yes. UI-wise, no. People have different expectations for https:// https:// URLs, which would be broken if browsers simply accepted any self-signed cert. No excuse for the mailer behaviour, though.
vtlynch 11y ago
>Now anyone who wants to setup a website, for whatever reason, has to go thru some central authority Which 99% of people already do when the buy a domain name. There is NO evidence that using SSL restricts your freedom of speech. There is evidence to the contrary though, where SSL allowed people to speak freely without having their communications intercepted or monitored. Certificate Authorities only reject websites for certificates in rare cases where the domain bears resemblance to a well known company (such as "paaypal.com" or "microsoftproducts.com"). This is not something that every CA does not something that a CA HAS to do. There is no "false" sense of security HTTPS IS encrypted, and CA signed certificates ARE authenticated. Claims that the whole CA system is MiTM by government are largely unsupported, and if you believe that, then you are screwed over HTTP anyway. I dont disagree that there are some disadvantages to an HTTPS-only web, but those generalizations are wrong.
- idibidiart 11y ago
  "HTTPS IS encrypted" Oh wow. Really? You haven't done your homework then. So many ways to undermine the certificate authority model, including many famous cases, one involving the Iranian government gaining access to their citizen's "encrypted" traffic. HTTPs is about having traffic be open to powerful entities and closed off to the common criminal. It's a two tier model, not real security.

mangeletti 11y ago

It's worth noting that Akamai is on the board of the parent organization of Let's Encrypt.

johncolanduoni 11y ago

> it's just another way to control free speech and what people do with the web How so? Do you expect browsers to stop serving content from sites using boring old HTTP? And the fact is that we've had to go through a central authority to put a website up for a long time, with DNS.

bandrami 11y ago

Thank you. Demanding TLS while insisting on keeping our broken PKI alive is saying that anonymous publishing is impossible. Just look at the stupid way browsers treat self-signed certificates: these are strictly better than plaintext, but plaintext gets no warning and self-signed certificates are warned about and in some cases actually blocked. Similarly, one mailer (exim, I think?) on seeing an untrusted certificate would actually downgrade to plaintext. There aren't enough palms or enough faces for that.

icebraining 11y ago
Just look at the stupid way browsers treat self-signed certificates: these are strictly better than plaintext, but plaintext gets no warning and self-signed certificates are warned about and in some cases actually blocked. Technically, yes. UI-wise, no. People have different expectations for https:// https:// URLs, which would be broken if browsers simply accepted any self-signed cert. No excuse for the mailer behaviour, though.

vtlynch 11y ago

>Now anyone who wants to setup a website, for whatever reason, has to go thru some central authority Which 99% of people already do when the buy a domain name. There is NO evidence that using SSL restricts your freedom of speech. There is evidence to the contrary though, where SSL allowed people to speak freely without having their communications intercepted or monitored. Certificate Authorities only reject websites for certificates in rare cases where the domain bears resemblance to a well known company (such as "paaypal.com" or "microsoftproducts.com"). This is not something that every CA does not something that a CA HAS to do. There is no "false" sense of security HTTPS IS encrypted, and CA signed certificates ARE authenticated. Claims that the whole CA system is MiTM by government are largely unsupported, and if you believe that, then you are screwed over HTTP anyway. I dont disagree that there are some disadvantages to an HTTPS-only web, but those generalizations are wrong.

idibidiart 11y ago
"HTTPS IS encrypted" Oh wow. Really? You haven't done your homework then. So many ways to undermine the certificate authority model, including many famous cases, one involving the Iranian government gaining access to their citizen's "encrypted" traffic. HTTPs is about having traffic be open to powerful entities and closed off to the common criminal. It's a two tier model, not real security.