4 ms·

"problems that absolutely need solving _before_ a forced global deployment of TLS can happen" I'm all for this switch to SSL. But there's no way Mozilla's anno

"problems that absolutely need solving _before_ a forced global deployment of TLS can happen" I'm all for this switch to SSL. But there's no way Mozilla's announcement will effect global deployment of TLS... not with 11.7% market share (NetMarketShare.com, https://www.netmarketshare.com/browser-market-share.aspx?qprid=0&qpcustomd=0 https://www.netmarketshare.com/browser-market-share.aspx?qpr...). The realist in me says this will just frustrate developers as staunch advocates of Firefox pester for working services while higher-ups refuse to justify the cost to suit a possible minority userbase. These users being forced to either switch browser or move service provider.

kazazes 11y ago
Chromium/Chrome have already proposed a step in the same direction, pushing your market share figure up to 37.4%. [1] [1] https://www.chromium.org/Home/chromium-security/marking-http-as-non-secure https://www.chromium.org/Home/chromium-security/marking-http...
- mbrubeck 11y ago
  Another related step from the Chromium developers: https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/2LXKVWYkOus/discussion https://groups.google.com/a/chromium.org/forum/#!topic/blink...
silon5 11y ago
IMO, before http is deprecated, we need public key in DNS support, bypassing the CA system. It would possibly be a lower level of security than CA cert, but would be good for many sites.
- danudey 11y ago
  That's kind of the issue. There's basically two circumstances where I want to connect with a remote site: 1. I don't care who they are, I just want to read their content (any site I'm not going to log into, e.g. blog posts, etc) 2. I care who they are, I need to know they're them (banks, HN, Twitter, etc.) The current CA system provides the second one, but fundamentally it would be nice if, with the lack of a CA-verified certificate, the server/browser would just encrypt the connection anyway.
  - zurn 11y ago
    TLS doesn't require CA. Browsers just decided they do, so they're rejecting any such https connections (anon DH and anon ECDH connections).

kazazes 11y ago

Chromium/Chrome have already proposed a step in the same direction, pushing your market share figure up to 37.4%. [1] [1] https://www.chromium.org/Home/chromium-security/marking-http-as-non-secure https://www.chromium.org/Home/chromium-security/marking-http...

mbrubeck 11y ago
Another related step from the Chromium developers: https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/2LXKVWYkOus/discussion https://groups.google.com/a/chromium.org/forum/#!topic/blink...

silon5 11y ago

IMO, before http is deprecated, we need public key in DNS support, bypassing the CA system. It would possibly be a lower level of security than CA cert, but would be good for many sites.

danudey 11y ago
That's kind of the issue. There's basically two circumstances where I want to connect with a remote site: 1. I don't care who they are, I just want to read their content (any site I'm not going to log into, e.g. blog posts, etc) 2. I care who they are, I need to know they're them (banks, HN, Twitter, etc.) The current CA system provides the second one, but fundamentally it would be nice if, with the lack of a CA-verified certificate, the server/browser would just encrypt the connection anyway.
- zurn 11y ago
  TLS doesn't require CA. Browsers just decided they do, so they're rejecting any such https connections (anon DH and anon ECDH connections).