4 ms·

There is no way the scheme could possibly work. For example my printer is managed over HTTP. I'd have to keep two browsers around - the current (non-http supp

There is no way the scheme could possibly work. For example my printer is managed over HTTP. I'd have to keep two browsers around - the current (non-http supporting) version, and an older (insecure etc) version for all the things still using HTTP. I also don't see Netgear/Linksys/Dlink/Foscam doing firmware updates for all their devices out in the field, and even if they did they would require management over HTTP in order to transform them to TLS. Or in other words, you could cut off support for the major sites/devices using HTTP, but could never do it for everything in the next 6 months. Since you are advocating TLS support being mandatory, then it dropping HTTP for a different protocol is worth considering. HTTP/2 is a strong consideration, and currently is always over TLS.

IgorPartola 12y ago
Perhaps browsers could include a "legacy mode" where stuff behind an IPv4 NAT could still be accessible over HTTP. This would of course require all manner of warnings. In general though, my router has a self-signed cert and works over HTTPS. I can even load my own cert. OpenWRT FTW.
- rogerbinns 12y ago
  > This would of course require all manner of warnings Ok, now try and word one of those so that regular folk understand what the heck it is saying. And your "legacy mode" means HTTP is still supported. There is nothing wrong with deprecating HTTP over bare TCP, but being completely unsupported in the near future is unworkable. Everyone including this effort is about a slow steady migration.