3 ms·

Yeah. I was really against SPDY/HTTP2 only supporting encrypted websites until Let's Encrypt came along, as it would have "forced" all the small sites to keep u

Yeah. I was really against SPDY/HTTP2 only supporting encrypted websites until Let's Encrypt came along, as it would have "forced" all the small sites to keep using HTTP 1.1 forever. Now I don't mind the requirement at all. https://news.ycombinator.com/item?id=6724292 https://news.ycombinator.com/item?id=6724292

lucb1e 11y ago
From what I got, it forces opportunistic encryption only. If there is no special signed cert available, it just generates one randomly and uses that. Unsafe against people who can modify your connection, but it protects against passive eavesdropping.
- pfg 11y ago
  All major browser vendors decided not to implement opportunistic encryption in HTTP/2.
  - lucb1e 11y ago
    So they force either a valid cert or nothing? Not even unencrypted http/2? Because that would be quite awesome. Edit: are there statements where they say they don't intend to implement it ever, or is it just not supported yet and e.g. Microsoft might still implement it later to please some enterprise stakeholder?
    - pfg 11y ago
      According to this[1], that's a permanent decision. Given that both Google and Mozilla have discussed plans that would eventually mark http:// http:// as unsafe in the UI, I don't think that decision is going to change. [1]: https://daniel.haxx.se/blog/2015/03/06/tls-in-http2/ https://daniel.haxx.se/blog/2015/03/06/tls-in-http2/
      - lucb1e 11y ago
        Well there is a difference between unsigned encrypted and unencrypted, I'm not saying marking http:// http:// as unsafe implies that they'll always regard unsigned encrypted as completely unprotected, especially with closed source browsers (or browsers where development is a closed process). Thanks for all the information though! :)
        aidenn0 11y ago
        From the point of view of an active MITM attack there is no difference between unsigned encrypted and unencrypted.

lucb1e 11y ago

From what I got, it forces opportunistic encryption only. If there is no special signed cert available, it just generates one randomly and uses that. Unsafe against people who can modify your connection, but it protects against passive eavesdropping.

pfg 11y ago
All major browser vendors decided not to implement opportunistic encryption in HTTP/2.
- lucb1e 11y ago
  So they force either a valid cert or nothing? Not even unencrypted http/2? Because that would be quite awesome. Edit: are there statements where they say they don't intend to implement it ever, or is it just not supported yet and e.g. Microsoft might still implement it later to please some enterprise stakeholder?
  - pfg 11y ago
    According to this[1], that's a permanent decision. Given that both Google and Mozilla have discussed plans that would eventually mark http:// http:// as unsafe in the UI, I don't think that decision is going to change. [1]: https://daniel.haxx.se/blog/2015/03/06/tls-in-http2/ https://daniel.haxx.se/blog/2015/03/06/tls-in-http2/
    - lucb1e 11y ago
      Well there is a difference between unsigned encrypted and unencrypted, I'm not saying marking http:// http:// as unsafe implies that they'll always regard unsigned encrypted as completely unprotected, especially with closed source browsers (or browsers where development is a closed process). Thanks for all the information though! :)
      - aidenn0 11y ago
        From the point of view of an active MITM attack there is no difference between unsigned encrypted and unencrypted.