Re: Mandatory encryption *is* theater

Will,

On 8/25/13 5:29 PM, William Chan (陈智昌) wrote:
>
> Another key distinction is encryption does not require authentication,
> so a proper cert is not mandatory. I'm surprised you mention requiring
> a proper cert given that you clearly understand a proper cert isn't
> necessary, given your reply to Yoav below. I think it's worthwhile to
> discuss the asserted benefit, but any statement about the current
> proposal requiring proper certificates sounds factually incorrect as
> far as I can tell. Did I miss something here?
>

Possibly you did or possibly I did.  I have two specific issues with
anonymous encryption:

1.  The threat it is addressing may be better dealt with at other
layers; and
2.  It is often sold as more than it is.

As I wrote, I do like the idea of DANE + DNSSEC and then expanding on
that.  Got code for that?  If it's real privacy (not just encryption)
then I'd probably be convinced (there is a matter of responsibility, but
I think  DANE + DNSSEC could get us there, as can certs from credible CAs).

And just for the record:

> Yes, the proposal is that it is mandatory for the server to implement
> and offer encryption.

That is in fact my objection, particularly the "offer" part.  You seem
to be assuming (forgive me if you are not) that many implementations
small and large AND many deployments small and large will do a whole lot
of work for that offer where past experience shows that they won't, but
rather that it will in fact hinder implementation and deployment of the
rest of HTTP2.  There is an obvious question about the goals for HTTP2...

Eliot