W3C home > Mailing lists > Public > public-webappsec@w3.org > December 2014

Re: Proposal: Marking HTTP As Non-Secure

From: Igor Bukanov <igor@mir2.org>
Date: Sun, 14 Dec 2014 21:04:04 +0100
Message-ID: <CADd11yWXd6+vGdrRK+HPsJUnyWM4js47RJz6GpT2fcvs8e7-HA@mail.gmail.com>
To: Michal Zalewski <lcamtuf@google.com>
Cc: Chris Palmer <palmer@google.com>, Eduardo Robles Elvira <edulix@agoravoting.com>, "dev-security@lists.mozilla.org" <dev-security@lists.mozilla.org>, blink-dev <blink-dev@chromium.org>, "public-webappsec@w3.org" <public-webappsec@w3.org>, security-dev <security-dev@chromium.org>
On 14 December 2014 at 20:47, Michal Zalewski <lcamtuf@google.com> wrote:

> The main point of having a visible and stable indicator for encrypted
> sites is to communicate to the user that the site offers a good degree
> of resilience against the examination or modification of the exchanged
> data by network attackers.
>

Then browser should show absolutely no indications of secure origin for
encrypted http://. The idea is that encrypted http:// experience would be
equivalent to the current http experience with no indications of security
and no warnings. However, encrypted http:// with insecure elements will
start to produce warnings in the same way a future browser will show
warnings for plain http.

Without something like this I just do not see how a lot of sites could ever
start enabling encryption unconditionally. I.e. currently enabling https
requires to modify content often in a significant way. I would for a site
operator to have an option to enabling encryption unconditionally without
touching the content.
Received on Monday, 15 December 2014 08:56:36 UTC

This archive was generated by hypermail 2.3.1 : Monday, 23 October 2017 14:54:08 UTC