> I want a "secure by default" internet with all the things encrypted all the time Not this way, though. There are certainly security problems with non-ssl tra

> I want a "secure by default" internet with all the things encrypted all the time Not this way, though. There are certainly security problems with non-ssl traffic, but the cure may be worse than the disease. If browsers continue restricting access to non-ssl sites, lawmakers might try to regulate who can get a cert, and what root CAs web browsers can include. This will turn the web into a walled garden. At first, it will probably be a blacklist of scam sites, so everyone goes along with it, then terrorist, piracy and child porn content, eventually an App Store like model, with the EU and the US acting as gatekeepers. Using a different, illegal browser or operating system might not be an option, as that's also starting to require certificates, see notarization and secure boot. The right way would be warning users if a site's cert changes, but without root CAs (like in SSH). The WPA3 protocol, which can also work in passwordless networks, is a welcome development too. A combination of those two would solve 80% of the problem, without creating those risks.