Re: [webpayments] Should we be concerned about the use of the Browser API in a non-HTTPS environment? (#20)

> Should the Browser API be restricted to HTTPS-only environments?

Yes, we want the attack surface as small as we can make it while delivering on the important use cases. I can't think of an advantage that HTTP-only brings other than a potential reduction in cost for buying an HTTPS certificate (and hopefully that's going away soon w/ Let's Encrypt).

---
Reply to this email directly or view it on GitHub:
https://github.com/w3c/webpayments/issues/20#issuecomment-161178460