W3C home > Mailing lists > Public > ietf-http-wg@w3.org > July to September 2012

Re: Semantics of HTTPS

From: Mark Nottingham <mnot@mnot.net>
Date: Thu, 13 Sep 2012 15:06:24 +1000
Cc: "Adrien W. de Croy" <adrien@qbik.com>, Willy Tarreau <w@1wt.eu>, "ietf-http-wg@w3.org Group" <ietf-http-wg@w3.org>
Message-Id: <53FE12F6-33BE-4731-8E20-72A79496EB80@mnot.net>
To: Eric Rescorla <ekr@rtfm.com>
I haven't seen any more discussion of this. 

Being that both the TLS WG Chair and at least one security AD have both unambiguously said that it should be considered an e2e protocol (please correct if I'm wrong), we return to the original question --

Should we state that the HTTPS URI scheme implies end-to-end security (i.e., between the user-agent and the origin server)?


On 26/08/2012, at 11:51 AM, Eric Rescorla <ekr@rtfm.com> wrote:

> On Mon, Aug 6, 2012 at 3:39 PM, Adrien W. de Croy <adrien@qbik.com> wrote:
>> Anyone here from the TLS WG able to comment on whether there are plans to
>> combat MITM in this respect?  It's interesting to see the comment about
>> recent TLS WG rejection of support for inspection.
> As TLS WG Chair:
> 1. As Stephen says, the TLS WG saw a presentation about explicit support
> for proxies and there was very little support in the room for that idea. This
> isn't to say that some future version of this idea would not be accepted,
> but there are no current plans in this area.
> 2. RFC 2818 was a TLS WG item, so any updates to that would really need
> to be done by the TLS WG.
> -Ekr

Mark Nottingham   http://www.mnot.net/
Received on Thursday, 13 September 2012 05:06:58 UTC

This archive was generated by hypermail 2.4.0 : Friday, 17 January 2020 17:14:03 UTC