RE: ext#9: OppSec and Proxies

Hi Mark,



Thank for giving me the opportunity to continue the discussion.



Currently a mobile client can already OppSec connect to performance proxies (Google DCP and Opera cases were discussing in meeting) hosted on the Internet, but one at a time.  These proxies implement functions like caching, compression or translation to improve customer experiences. Most of them encrypt the HTTP traffic but in different manners.



In all the cases these proxies don’t work well with services already deployed locally by the network operator the handset is connected too. The mitigation, if any, is performed with very poor mechanisms which do not allow the usage of an OppSec connection with the proxy of the network operator.



So there is gap here that we may describe in the proxy-problems draft and that we may start addressing in the http2-encryption draft.



Cheers

Emile



-----Original Message-----
From: Mark Nottingham [mailto:mnot@mnot.net]
Sent: mardi 29 juillet 2014 08:38
To: HTTP Working Group
Subject: ext#9: OppSec and Proxies



<https://github.com/httpwg/http-extensions/issues/9>



We discussed this issue in Toronto, and the sense of the room there was to close this issue with no action, since there are a lot of different scenarios for how a client uses a proxy, as well as different kinds of proxies which might cause clients to do different things.



Any more discussion?



Regards,





--

Mark Nottingham   https://www.mnot.net/






_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.