Re: SSL/TLS everywhere fail

On Sat, Dec 5, 2015 at 1:55 AM, Alex Rousskov <
rousskov@measurement-factory.com> wrote:

>
> Not in a technical sense. And we should not talk politics here.
>
>
The technical implications of policy (and vice versa) is certainly germane
to the making of standards. Things would be easier if that weren't true but
its not a good option to pretend otherwise. What we should avid here, imo,
is any talk not related to a standard we are working on even if it is of
general interest. This discussion seems in scope (if tedious :)).


> > Firefox definitely supports https proxies. I think that Chrome does too.
>
> For FireFox, this is a relatively recent and partial change, not yet
> available via regular configuration options AFAICT. I have not checked
> Chrome. It is nice that browsers are finally adding that support, of
> course!
>
>
Firefox "proxy over https" support was released in October 2014; Chrome
beat us to it. I've heard microsoft banter on the topic, but I'm not sure
if it is currently available. In both browsers you can do h1/h2/spdy over
that link - including mux'd connect tunnels within one h2/spdy session to
the proxy with proxies that support h2/spdy This has some really nice TCP
side-effects when done over poor links. Still waiting for several proxies
to pick up that feature. (that game works both ways :)..)

UI is done via PAC (which can be done without an external PAC file fwiw) in
both browsers. I think we will probably add a checkbox for it when we
update that configuration screen (For which I have a different reason to
schedule work anyhow, so this can piggyback).

But of course, this just authenticates the proxy and secures the transport
to it - it does not trust the proxy with https data split browser style. I
find it hard to imagine doing so would be in the best interest of our
users. Third parties that would like to be part of that conversation will
assert opportunity cost or just authority and disagree with my opinion.
cest la vie.

-P