5 ms·

Probably won't sit well with website owners. If you attempt to connect over TLS when it isn't supported, there is a performance impact, basically you have to at

by Edmond 10y ago

Probably won't sit well with website owners. If you attempt to connect over TLS when it isn't supported, there is a performance impact, basically you have to attempt one failed connection for every http request, do that for every request on a page and performance becomes a big problem. You'll also be going against specs, HTTP should go to port 80( which typically isn't secure.), a browser unilaterally deciding to go against a legitimate user wish is bad form.

marcosdumay 10y ago
Hum... If I explicitly type "http://example.com" http://example.com", then by all means, go to the plaintext site. But everybody just types "example.com" and expects the browser to go to the site - this one should favor the TLS version, not the plaintext one. Besides, now that most sites run on https, making the http-only ones slower would be a good thing.
- Edmond 10y ago
  I think the current approach of allowing site owners to decide how they're going to support TLS is the right approach, browsers taking it upon themselves to enforce it is a bad idea. Some additional reasons why it is a bad idea have already been mentioned by other folks. When it comes to security, TLS is crucial to the security infrastructure of the internet as a whole; however most of the current security problems on the internet don't actually involve TLS vulnerabilities, even though those tend to make a lot of news in the technology press. The bar for exploiting TLS vulnerabilities generally requires setting up a legitimate seeming entity and injecting yourself into the internet traffic routing infrastructure, it is very much possibly (and indeed easy for state actors) but it is a much higher bar for common cyber criminals.
  - marcosdumay 10y ago
    How is defaulting to https instead of http not allowing the site owners to decide? Currently site owners are not allowed to default into https on first visit. Trying both will give them this choice.
  - 3pt14159 10y ago
    They can decide themselves by 301ing to http and setting some sort of "I'm a crappy website, just use insecure requests" header.
    - Edmond 10y ago
      they can't 301 if they don't already support TLS. If you attempt to connect to a site over TLS that doesn't support it, for starters port 443 is not likely to be open. 301 is part of the HTTP protocol, TLS is transport layer.
byuu 10y ago
When I moved my message board to HTTPS, we had mixed content warnings on avatars. After adding a Content-Security-Policy header to upgrade insecure requests, we found that most sites without HTTPS failed quickly. But five or six people had domains that would "load" for 10+ seconds before finally timing out. Which had the effect of making forum topic pages take 10+ seconds to stop showing the "page loading" animation. Any site lacking HTTPS should instantly close connection attempts on port 443. But some it seems choose not to respond at all, making the browser unsure if the site is just slow or if an HTTPS service doesn't exist.

by Edmond 10y ago

marcosdumay 10y ago

Hum... If I explicitly type "http://example.com" http://example.com", then by all means, go to the plaintext site. But everybody just types "example.com" and expects the browser to go to the site - this one should favor the TLS version, not the plaintext one. Besides, now that most sites run on https, making the http-only ones slower would be a good thing.

Edmond 10y ago
I think the current approach of allowing site owners to decide how they're going to support TLS is the right approach, browsers taking it upon themselves to enforce it is a bad idea. Some additional reasons why it is a bad idea have already been mentioned by other folks. When it comes to security, TLS is crucial to the security infrastructure of the internet as a whole; however most of the current security problems on the internet don't actually involve TLS vulnerabilities, even though those tend to make a lot of news in the technology press. The bar for exploiting TLS vulnerabilities generally requires setting up a legitimate seeming entity and injecting yourself into the internet traffic routing infrastructure, it is very much possibly (and indeed easy for state actors) but it is a much higher bar for common cyber criminals.
- marcosdumay 10y ago
  How is defaulting to https instead of http not allowing the site owners to decide? Currently site owners are not allowed to default into https on first visit. Trying both will give them this choice.
- 3pt14159 10y ago
  They can decide themselves by 301ing to http and setting some sort of "I'm a crappy website, just use insecure requests" header.
  - Edmond 10y ago
    they can't 301 if they don't already support TLS. If you attempt to connect to a site over TLS that doesn't support it, for starters port 443 is not likely to be open. 301 is part of the HTTP protocol, TLS is transport layer.

byuu 10y ago

When I moved my message board to HTTPS, we had mixed content warnings on avatars. After adding a Content-Security-Policy header to upgrade insecure requests, we found that most sites without HTTPS failed quickly. But five or six people had domains that would "load" for 10+ seconds before finally timing out. Which had the effect of making forum topic pages take 10+ seconds to stop showing the "page loading" animation. Any site lacking HTTPS should instantly close connection attempts on port 443. But some it seems choose not to respond at all, making the browser unsure if the site is just slow or if an HTTPS service doesn't exist.