Re: New Version Notification for draft-nottingham-http2-encryption-03.txt

On Tue, May 20, 2014 at 3:45 PM, Martin Nilsson <nilsson@opera.com> wrote:

> On Tue, 20 May 2014 18:54:22 +0200, Martin Thomson <
> martin.thomson@gmail.com> wrote:
>
>
>> Maybe there's a case for further highlighting the distinction we want
>> to retain, at least at the broadest level of generality: https ==
>> secure, http == not.  That is the point of Section 6.1, but I might be
>> convinced that repetition of this is necessary.
>>
>>
> I assume that the set of ciphers you negotiate from would be the same here
> as for https. The performance difference isn't big, and you minimize your
> traffic analysis footprint by not having different TLS parameters for http
> and https URLs. Given this the only possible difference are the
> certificates, and they will be the same for http as https users of a
> specific site. So in practice there will be no difference between the
> actual connections for http and https in many cases. Should you still not
> show any security indicators in the UI?


Transport security is very different from web security. For example, only
some of the resources in a webpage may be opportunistically encrypted with
strong authentication. If there's active content like script that's loaded
without transport security, that can compromise the entire page. Pages
loaded using opportunistic encryption definitely do not deserve the same
security indicator as an https:// page. One might argue that they deserve
something better than nothing, but explaining this difference to users is
quite difficult already, so it seems inadvisable to further muddy the
distinction by introducing a middle ground security indicator.


>
>
> /Martin Nilsson
>
> --
> Using Opera's revolutionary email client: http://www.opera.com/mail/
>
>