4 ms·
If it were a foregone conclusion that HTTP/2 would have a non-secure mode, I'd agree, yes. But in practice HTTP/2 isn't going to have a non-secure mode in most
by jlebar 12y ago
If it were a foregone conclusion that HTTP/2 would have a non-secure mode, I'd agree, yes. But in practice HTTP/2 isn't going to have a non-secure mode in most browsers.
Maybe you're arguing that it would be better to have an insecure but encrypted mode in all browsers? Could be, but I don't think so. As it is, if a site wants the benefits of HTTP/2, they have to establish actually secure communication (inasmuch as CAs provide that). It seems good to me to use the performance benefits of HTTP/2 as a carrot to accomplish real encryption everywhere. If the costs of getting a cert were too high, then maybe this would leave many websites stuck on HTTP/1, which would be worse than having those sites use an encrypted-but-insecure mode in HTTP/2, but I don't think that will be the case.
- drzaiusapelord 12y ago>Maybe you're arguing that it would be better to have an insecure but encrypted mode in all browsers? Pretty sure this is what we're doing today with smtps. We just wrap smtp in tls and call it a day. Its dangerous and allows for mitm attacks. I think there was a paper recently about how this is already being abused. I just dont see where people who believe in self-signed certs as a solution to all our encryption woes are coming from. Its historically and technically has shown itself to be a security nightmare for most use cases. I think people like this are more political than practical and think they can do non-trivial things without regulation, authorities, etc. Sorry, but that's just not how this world works.