3 ms·

What is going to be the protocol for development environment? Should one deal with ssl just to quickly test out the code? What if a service streams video, whic

by Danilka 12y ago

What is going to be the protocol for development environment? Should one deal with ssl just to quickly test out the code? What if a service streams video, which requires full screen feature? It takes quite a bit more compute power to pack it into encrypted connection, and what if the video is not of any value as a secure content. Why should people be forced to encrypt and decrypt spending extra power (battery, in case of portable devices) on it? SSL does not guarantee the security de-facto. Also, there is plenty of personal data that is being passed through a non-encrypted connection, which is way more valuable. If this is an attempt to increase amount of secure connections, it is a very inconvenient one. Why not keep giving bonus point for using it (like SEO higher ranking) rather than making pure HTTP not usable.

icebraining 12y ago
What if a service streams video, which requires full screen feature? It takes quite a bit more compute power to pack it into encrypted connection, and what if the video is not of any value as a secure content. Why should people be forced to encrypt and decrypt spending extra power (battery, in case of portable devices) on it? Because otherwise a MITM can abuse the fullscreen feature. SSL is a way of ensuring content integrity, not just privacy. I do think we should have a way of signing content without mandating encryption for these use cases, but until we do, HTTPS is the only choice.
- userbinator 12y ago
  I do think we should have a way of signing content without mandating encryption for these use cases SSL has it, it's just usually disabled by default - null encryption with non-null MAC.
pornel 12y ago
DevTools can whitelist dev domains: https://w3c.github.io/webappsec/specs/powerfulfeatures/#development-environments https://w3c.github.io/webappsec/specs/powerfulfeatures/#deve... > What if a service streams video; […] spending extra power (battery, in case of portable devices) Then they'll encrypt, because it's cheap. YouTube could do it. Only Netflix is making a fuss because they want to legitimize their DRM as a security layer. It's not 1995 any more. Today even low-end cell phones are orders of magnitude faster than CPUs were when SSL was slow. We've got fast ciphers and hardware-accelerated decoding. https://istlsfastyet.com/ https://istlsfastyet.com/ > SSL does not guarantee the security de-facto. The problem is that HTTP is de-facto guaranteeing insecurity. • HTTPS is the new HTTP. • HTTPS+HSTS+preloaded pinning is the new HTTPS.

by Danilka 12y ago

icebraining 12y ago

What if a service streams video, which requires full screen feature? It takes quite a bit more compute power to pack it into encrypted connection, and what if the video is not of any value as a secure content. Why should people be forced to encrypt and decrypt spending extra power (battery, in case of portable devices) on it? Because otherwise a MITM can abuse the fullscreen feature. SSL is a way of ensuring content integrity, not just privacy. I do think we should have a way of signing content without mandating encryption for these use cases, but until we do, HTTPS is the only choice.

userbinator 12y ago
I do think we should have a way of signing content without mandating encryption for these use cases SSL has it, it's just usually disabled by default - null encryption with non-null MAC.

pornel 12y ago

DevTools can whitelist dev domains: https://w3c.github.io/webappsec/specs/powerfulfeatures/#development-environments https://w3c.github.io/webappsec/specs/powerfulfeatures/#deve... > What if a service streams video; […] spending extra power (battery, in case of portable devices) Then they'll encrypt, because it's cheap. YouTube could do it. Only Netflix is making a fuss because they want to legitimize their DRM as a security layer. It's not 1995 any more. Today even low-end cell phones are orders of magnitude faster than CPUs were when SSL was slow. We've got fast ciphers and hardware-accelerated decoding. https://istlsfastyet.com/ https://istlsfastyet.com/ > SSL does not guarantee the security de-facto. The problem is that HTTP is de-facto guaranteeing insecurity. • HTTPS is the new HTTP. • HTTPS+HSTS+preloaded pinning is the new HTTPS.