W3C home > Mailing lists > Public > ietf-http-wg@w3.org > January to March 2015

comprehensive TLS is not the solution, it's a bug ... (was 2 questions)

From: Walter H. <walter.h@mathemainzel.info>
Date: Tue, 31 Mar 2015 07:30:14 +0200
Message-ID: <880c6444186187addd3b67cc91230de4.1427779814@squirrel.mail>
To: "Dan Anderson" <dan-anderson@cox.net>
Cc: ietf-http-wg@w3.org
On Mon, March 30, 2015 22:33, Dan Anderson wrote:
>> think of someone or company uses Internet for e-commerce; e.g. presenting
>> his products is public for anybody; this doesn't need to be presented in
>> TLS,
>
> Is this still a valid assumption?

Yes, why see below ...

> I might not particularly, initially, care about confidentiality.  But I
> think I would still care about the integrity benefits (Am I talking to the
> site I think I am talking to?, is there a man in the middle?, etc.)

just look at this screens-shot
http://imgbin.org/images/23055.png
(this was made at http://www.zalando.at/ - I'm Austrian and this is a
internet shop, but ... - my proxy blocks advertising in a very agressive
way)

> I can't think of a case where I would not want this assurance.

do you still think TLS would give you the "assurance", everything in the
browser windows comes from the host shown in the address bar, even when
its the kidding green bar?

> And I can think of all sort of nefarious things to do to others when they
> don't have this assurance.

really?

> So I am disappointed that we are not taking the opportunity to fix this.

Yes, fix this by only allowing relative URLs inside https-sites ..., or in
other words, restricting access to ONLY the host shown in the address bar,
when presenting the site with TLS in the browser windows ...

Much luck ;-)

by the way:
can you please read this:
https://datatracker.ietf.org/doc/draft-hoehlhubmer-https-addon/
I want this to be a RFC

Thanks,
Walter

p.s. guess why the garbage collection isn't escorted by the police,
but the transport of money is ...
Received on Tuesday, 31 March 2015 05:30:40 UTC

This archive was generated by hypermail 2.4.0 : Friday, 17 January 2020 17:14:43 UTC