Re: 2 questions

------ Original Message ------
From: "Dan Anderson" <dan-anderson@cox.net>
To: "Walter H." <Walter.H@mathemainzel.info>
Cc: "ietf-http-wg@w3.org" <ietf-http-wg@w3.org>
Sent: 31/03/2015 9:33:49 a.m.
Subject: Re: 2 questions

> >think of someone or company uses Internet for e-commerce; e.g. 
>presenting his products is public for anybody; this doesn't need to be 
>presented in TLS,
>
>Is this still a valid assumption?
>
>I might not particularly, initially, care about confidentiality.  But I 
>think I would still care about the integrity benefits (Am I talking to 
>the site I think I am talking to?, is there a man in the middle?, etc.)

so how do you get integrity benefits when there is a MitM?  Client 
certificates?  Good luck with that.

>
>I can't think of a case where I would not want this assurance.
I understand the desire for the assurance, and agree.  But it's just not 
there.


>And I can think of all sort of nefarious things to do to others when 
>they don't have this assurance.
>
>So I am disappointed that we are not taking the opportunity to fix 
>this.
I wonder what opportunity we have.  Moving to TLS everywhere does not do 
it.  Client certificates maybe.

I wonder how many people know what certs are in their trusted root 
store.  And keep an eye on it.

Adrien


>
>Dan
>
>On Mon, Mar 30, 2015 at 2:32 PM, Walter H. <Walter.H@mathemainzel.info> 
>wrote:
>>On 30.03.2015 02:50, Mike Bishop wrote:
>>>You're skipping the discussion about why price of the cert is not the 
>>>cost of running TLS.  There's admin overhead in renewing the cert for 
>>>each domain, there's network infrastructure overhead in providing 
>>>each domain a unique IP address (because you can't guarantee every 
>>>client supports SNI, much as we'd like to), and that additional 
>>>network infrastructure cost means hosting becomes more expensive.
>>that a server needs more cpu, memory and more other resources when 
>>sending content using TLS in comparison to just send them plain, this 
>>is true;
>>also it is true, that you need someone who renews the certs; also that 
>>you need a unique IP address; but it is not impossible doing so, the 
>>available resources would be enough;
>>even IP addresses;
>>let me explain a little example at the end, why you are right and more 
>>wrong at the same time;
>>
>>>But fundamentally, the argument was that if HTTP/2 needed to cover 
>>>the same scenarios as HTTP/1.1,
>>not really; or do you really think there is the need of something new 
>>that is the same as the old?
>>
>>here the example:
>>
>>think of someone or company uses Internet for e-commerce; e.g. 
>>presenting his products is public for anybody; this doesn't need to be 
>>presented in TLS,
>>but when someone enters data to order the products, this must be done 
>>using TLS;
>>compareable to a bank; the presentation of all products of the bank - 
>>e.g. interest rates, common terms and conditions, ... - can be 
>>presented
>>for the public without the need of TLS, but the service of electronic 
>>banking must only be with TLS;
>>
>>now think of the "next step", the website shows advertising for what 
>>the company gets money, that reduces the hosting costs;
>>this can be done in 2 ways: using a 3rd party, this is less efficient, 
>>compare it to a folder together with a newspaper;
>>or without, the most efficient way, compare it to a newspaper that has 
>>printed the advertisings anywhere between
>>the news and other informations;
>>
>>now think of the people that do not want see the advertisings; with 
>>the newspaper it is easy to bring them showing on the advertisings,
>>just print them anywhere between the news; an enclosed folder with 
>>advertisings can be thrown away without being really noticed;
>>
>>a little analogy: a user can easily block 3rd party advertisings by 
>>blocking just these domains; for this it would not make any difference 
>>if it is sent plain or encrypted using TLS,
>>because this blockings are domain/host specific;
>>if the advertisings are done without 3rd party, then a user might 
>>block specifics URLs - this and the above steps can be done centrally 
>>at a proxy server;
>>but when the whole is only sent encrypted using TLS, anybody can only 
>>stop the advertisings from being loaded by himself/herself without 
>>breaking the
>>end-to-end encryption; a proxy server doesn't help to prevent this, 
>>except it does man-in-the-middle;
>>
>>so now the question for you: do you really think, TLS costs you so 
>>much more that any way of reducing the whole hosting costs isn't it 
>>worth of doing TLS?
>>
>>by the way:
>>can you please read this:
>>https://datatracker.ietf.org/doc/draft-hoehlhubmer-https-addon/
>>I want this to be a RFC
>>
>>Thanks,
>>Walter
>>
>>
>