3 ms·

I thought I addressed that in a couple of different ways, but no I didn't forget. I'm not saying that TLS doesn't have benefits. I'm just saying that a blanke

by Steeeve 10y ago

I thought I addressed that in a couple of different ways, but no I didn't forget. I'm not saying that TLS doesn't have benefits. I'm just saying that a blanket policy is a bad idea for the US Government. If the policy for secure connectivity was "support-but-don't require" or "make your best effort to support" it would make more sense to me.

konklone 10y ago
It's just basic connection integrity -- without HTTPS, there's no guarantee the user is actually getting the content that the site meant to send, and vice versa. Those kind of attacks really do happen, and at scale (e.g. Verizon XUID, or China's Great Cannon). If it's at all interesting, I laid out in detail, with examples, why I've been comfortable taking a very hard line on deprecating HTTP: https://konklone.com/post/were-deprecating-http-and-its-going-to-be-okay https://konklone.com/post/were-deprecating-http-and-its-goin...