3 ms·

All major browser vendors decided not to implement opportunistic encryption in HTTP/2.

• lucb1e 11y ago
  So they force either a valid cert or nothing? Not even unencrypted http/2? Because that would be quite awesome. Edit: are there statements where they say they don't intend to implement it ever, or is it just not supported yet and e.g. Microsoft might still implement it later to please some enterprise stakeholder?
  • pfg 11y ago
    According to this[1], that's a permanent decision. Given that both Google and Mozilla have discussed plans that would eventually mark http:// http:// as unsafe in the UI, I don't think that decision is going to change. [1]: https://daniel.haxx.se/blog/2015/03/06/tls-in-http2/ https://daniel.haxx.se/blog/2015/03/06/tls-in-http2/
    • lucb1e 11y ago
      Well there is a difference between unsigned encrypted and unencrypted, I'm not saying marking http:// http:// as unsafe implies that they'll always regard unsigned encrypted as completely unprotected, especially with closed source browsers (or browsers where development is a closed process). Thanks for all the information though! :)
      • aidenn0 11y ago
        From the point of view of an active MITM attack there is no difference between unsigned encrypted and unencrypted.