3 ms·

Right, but doing this for HTTPS URLs would change the semantics of those URLs. People expect HTTPS to mean you either have a trusted CA certificate or you see a

by pfg 10y ago

Right, but doing this for HTTPS URLs would change the semantics of those URLs. People expect HTTPS to mean you either have a trusted CA certificate or you see a big, red warning. Changing these semantics would be terrible for security. You can argue for opportunistic encryption in HTTP, but I'd argue that it's cheaper and easier for most affected parties if browser vendors just help push the price of publicly-trusted certificates to zero, which is exactly what Mozilla and Chrome (among others) did. Rolling out a new protocol would've taken years as well, so I don't think we've lost much time choosing this approach.

ubernostrum 10y ago
People expect HTTPS to mean you either have a trusted CA certificate or you see a big, red warning. Changing these semantics would be terrible for security. No. You and some other folks on HN expect that. The general public does not know or care that HTTPS conflates multiple issues. Some random person who just wants to have a secure way to hit the login page of their blog does not know or care. There's room for a spectrum of things and ways to indicate where on that spectrum a particular site is, but HTTPS has been forced to be the one-size-fits-every-entity-in-the-universe solution and so has bundled in things that just aren't relevant to a lot of use cases and made it a binary "either you implement 100% of this 100% of the time or else" proposition when that makes no sense to do.
- chris_wot 10y ago
  Hence the huge warning page in Chrome warning about certificate errors. In the corporation I work for it has stopped a number of very nasty sites from compromising our security. So hence, it's working.
- TazeTSchnitzel 10y ago
  > The general public does not know or care that HTTPS conflates multiple issues. Not quite. The general public is taught (often in school!) to trust “https://” https://” links. You can't trust that a self-signed certificate is from the site is claims. You don't even know if you're safe from your WiFi hotspot.

by pfg 10y ago

ubernostrum 10y ago

People expect HTTPS to mean you either have a trusted CA certificate or you see a big, red warning. Changing these semantics would be terrible for security. No. You and some other folks on HN expect that. The general public does not know or care that HTTPS conflates multiple issues. Some random person who just wants to have a secure way to hit the login page of their blog does not know or care. There's room for a spectrum of things and ways to indicate where on that spectrum a particular site is, but HTTPS has been forced to be the one-size-fits-every-entity-in-the-universe solution and so has bundled in things that just aren't relevant to a lot of use cases and made it a binary "either you implement 100% of this 100% of the time or else" proposition when that makes no sense to do.

chris_wot 10y ago
Hence the huge warning page in Chrome warning about certificate errors. In the corporation I work for it has stopped a number of very nasty sites from compromising our security. So hence, it's working.
TazeTSchnitzel 10y ago
> The general public does not know or care that HTTPS conflates multiple issues. Not quite. The general public is taught (often in school!) to trust “https://” https://” links. You can't trust that a self-signed certificate is from the site is claims. You don't even know if you're safe from your WiFi hotspot.