4 ms·

The modern take that TLS only is required and must be enforced for everything, combined with the fact that TLS cert providers operate with normal power law popu

The modern take that TLS only is required and must be enforced for everything, combined with the fact that TLS cert providers operate with normal power law popularity, means that by blocking HTTP sites and making mixed HTTP+HTTPS sites unusable in ways like this large segments of the web will have single points of technical or political failure. TLS-*only* centralizes. LetsEncrypt's charter is made to resist corruption but as it's scale and the money involved grows it will probably end up going bad like dot Org did. That would be very bad for the web. Keeping HTTP and HTTP+HTTPS support around without stigmatizing or hiding it behind 2+ clickthrough warnings would prevent that failure mode.

heurisko 5y ago
> TLS-only centralizes. It depends what you mean by centralizes. I can buy an SSL certificate from any number of companies. There has to be some initial root point of trust.
- Santosh83 5y ago
  > There has to be some initial root point of trust. For security critical web apps, this makes sense. For mere documents and simple sites without authentication or sensitive information, self-signed certificates should become acceptable, IMO.
  - theandrewbailey 5y ago
    How does a browser know which URLs are 'critical web apps' so that it can, if necessary, throw a big scary warning to the user? What stops a random website from self-identifying as critical (or not)? The S in HTTPS guarantees things. If those guarantees are loosened, that can cause bad problems.
- hulitu 5y ago
  Do you trust this root point ? Are you sure that the root is not compromised ? Because Google is saying so ?
  - heurisko 5y ago
    My root certificates are provided by a Debian package, not Google, so if I'm trusting anyone, I'm trusting them. (And their judgement of the root certificates). It's not unheard of, that root certs are revoked for unsecure behaviour. It seems like the system works to me. https://en.m.wikipedia.org/wiki/DigiNotar https://en.m.wikipedia.org/wiki/DigiNotar
chrismorgan 5y ago
Your comment suggests you may think this is blocking all downloads over HTTP; it’s not: it’s only blocking a HTTPS → HTTP downgrade. I don’t believe any browser is making any noise at all about blocking HTTP sites, or is likely to try in the coming decade at least, though I do hope for them to start warning more about it, with more prominent “Insecure” labels and the likes.
hdjjhhvvhga 5y ago
That's why I explicitly keep all by websites accessible both via HTTP and HTTPS. I don't care what Google thinks about it and how they choose to punish me. Some of my visitors value the transparency, prevalence and accessibility of HTTP, some value the privacy and integrity of HTTPS. Nobody will force me to give up on HTTP.
- Wowfunhappy 5y ago
  Can I ask, which protocol do your users get by default? I would like to enable http on my personal website, but then browsers seem to give most users the http version. In other words, I would like to serve http://example.com http://example.com if and only if the user explicitly inputs the http protocol; anyone who types example.com should get https://example.com https://example.com. I haven't found a way to do this.
  - hdjjhhvvhga 5y ago
    The ones coming from Google use HTTPS because this is what Google chooses for them, and this is enough for me.

heurisko 5y ago

> TLS-only centralizes. It depends what you mean by centralizes. I can buy an SSL certificate from any number of companies. There has to be some initial root point of trust.

Santosh83 5y ago
> There has to be some initial root point of trust. For security critical web apps, this makes sense. For mere documents and simple sites without authentication or sensitive information, self-signed certificates should become acceptable, IMO.
- theandrewbailey 5y ago
  How does a browser know which URLs are 'critical web apps' so that it can, if necessary, throw a big scary warning to the user? What stops a random website from self-identifying as critical (or not)? The S in HTTPS guarantees things. If those guarantees are loosened, that can cause bad problems.
hulitu 5y ago
Do you trust this root point ? Are you sure that the root is not compromised ? Because Google is saying so ?
- heurisko 5y ago
  My root certificates are provided by a Debian package, not Google, so if I'm trusting anyone, I'm trusting them. (And their judgement of the root certificates). It's not unheard of, that root certs are revoked for unsecure behaviour. It seems like the system works to me. https://en.m.wikipedia.org/wiki/DigiNotar https://en.m.wikipedia.org/wiki/DigiNotar

chrismorgan 5y ago

Your comment suggests you may think this is blocking all downloads over HTTP; it’s not: it’s only blocking a HTTPS → HTTP downgrade. I don’t believe any browser is making any noise at all about blocking HTTP sites, or is likely to try in the coming decade at least, though I do hope for them to start warning more about it, with more prominent “Insecure” labels and the likes.

hdjjhhvvhga 5y ago

That's why I explicitly keep all by websites accessible both via HTTP and HTTPS. I don't care what Google thinks about it and how they choose to punish me. Some of my visitors value the transparency, prevalence and accessibility of HTTP, some value the privacy and integrity of HTTPS. Nobody will force me to give up on HTTP.

Wowfunhappy 5y ago
Can I ask, which protocol do your users get by default? I would like to enable http on my personal website, but then browsers seem to give most users the http version. In other words, I would like to serve http://example.com http://example.com if and only if the user explicitly inputs the http protocol; anyone who types example.com should get https://example.com https://example.com. I haven't found a way to do this.
- hdjjhhvvhga 5y ago
  The ones coming from Google use HTTPS because this is what Google chooses for them, and this is enough for me.