On Wed, Nov 13, 2013 at 7:09 PM, William Chan (陈智昌)
<willchan@chromium.org>replied to Wily:
>
> Just to be clear, the MITM works because the enterprises are adding new
> SSL root certificates to the system cert store, right? I agree that that is
> terrible. I wouldn't use that computer :) I hope we increase awareness of
> this issue.
>
>
This is a super important point. If someone can install a root cert onto
your computer then you are already owned - there is no end to the other
things they can do too. Call it a virus, call it an enterprise, but call it
a day - you're owned and there is no in-charter policy this working group
can enact to change the security level of that user for good or for bad..
The good news is not everyone is already owned and SSL helps those people
today.
[Wily said]
>
> You're suggesting anyone wanting to run an http2 server now has to
> purchase, and pay for the ongoing maintenance of a cert, and take the cost
> on additional CPU to handle the load?
>
[Will said]
> Yes, I want to use HTTP/2 as a carrot to incentivize server operators to
> use HTTPS. There are tradeoffs that prevent folks from adopting HTTPS. I'm
> hoping HTTP/2 helps adjust the tradeoffs in HTTPS' favor somewhat, due to
> its reduced user perceived latency and improved connection reuse leading to
> improved scalability compared to HTTP/1.X over TLS.
>
On balance, I agree with Will. This is my area of biggest concern though -
I hope and expect to see innovation in the PKI management space to make
things less painful. I had a side conversation in Vancouver about how
something like alternate-services can be used to support routing to full
https based on conditional understanding of SNI and I could imagine that
being a useful thing to help past a rough edge of https:// everywhere. I'm
interested in other practical ideas for easing the transition that people
might suggest.
As for tls-relaxed for http://, I agree with Mark's original
characterization that there are a lot of mixed opinions about it even
inside small organizations. Its not clear how to evaluate how much value it
has (if any) or how much it undermines https:// (if at all). The jury is
still out.
-P