Re: Draft finding - "Transitioning the Web to HTTPS"

On Wed, Dec 10, 2014 at 9:18 AM, Domenic Denicola <d@domenic.me> wrote:
>
>
> Nope, web crypto needs a secure transport to make any sense at all. It's a
> bootstrapping problem. If you're on an insecure channel (whether HTTP or
> employer-MITMed HTTPS), web crypto provides no guarantees at all.
>

​This is a side issue that we should not rathole on, but the reason the
WebCrypto Working Group declined to restrict WebCrypto to secure origins
was that there are some *limited* things that can be obtained with
WebCrypto even for HTTP sites. For example, confidentiality against passive
monitoring. The counter-argument is that such things are of no utility, but
that is a use-case-dependent judgement call, rather than a technical issue.

...Mark