4 ms·
You still can't self-sign certificates and rely on certificate pinning for transport security without domain verification. With all of the security concerns peo
by Sephr 13y ago
You still can't self-sign certificates and rely on certificate pinning for transport security without domain verification. With all of the security concerns people have with governments logging all unencrypted internet traffic, I was hoping HTTP 2.0 would require or at least optionally allow self-signed cert TLS for every http: connection (with no UI indication to the user that they are secure) and require CA-signed cert TLS for https:
We're also still stuck with DEFLATE, which is vastly inferior to modern compression formats like LZMA.
- samwillis 13y agoEncryption is only half the problem, authentication is the other. Self signed certificates don't authenticate the web server and allowing them would open the web up to MITM attacks. What we need is some form or decentralised certificate authority, i have no idea how that could work though. HTTP allready supports LZMA, its just the browser and web servers that dont. If a browser sent the header: Accept-Encoding: compress, gzip, lzma instead of: Accept-Encoding: compress, gzip and the server supported it, it would "just work". Unfortunately none of the major browsers or server have implemented it.
- Sephr 13y agoUnencrypted HTTP is already open to MITM attacks. What I proposed was using self-signed certificates in conjunction with certificate pinning, which means that as long as your first connection to a website isn't MITMed, later connections cannot be MITMed or snooped on. As for the compression, I was referring to LZMA for header compression. I am well aware of implementation efforts of LZMA in Firefox and Chrome.
- skrause 13y agoWhat we need is some form or decentralised certificate authority, i have no idea how that could work though. DNSSEC could be used to distribute certificates: https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na...
- jimktrains2 13y agoIsn't DNSSEC still have centralized certs for the tlds?
- justanother 13y agoThis was my main objection as well, after reading this. Make SPDY a standard, people say it's overengineered, but Goog and MSFT say it'll get us 10% performance benefit. Whatever, I trust them. And hey, think of all the next-generation tcpdump-style tools we'll get to write to decode the multiplexed connections (assuming any existing ones for SPDY won't already suffice). But while you're going to the trouble to push a new version of HTTP, why not put some sort of mandatory encryption in there? Make the browser generate its own RSA key when it's installed? Require pinned self-signed certificates at the absolute minimum? Hell, I'm not an expert, I just want the NSA to have to work harder.