Re: [MIX] Is origin an authenticated origin?

That works for me, and is more or less exactly what I'd have suggested.

That said, one nit: Chrome has no need to distinguish between "deprecated"
and "weak", but other browsers might.

--
Mike West <mkwst@google.com>
Google+: https://mkw.st/+, Twitter: @mikewest, Cell: +49 162 10 255 91

Google Germany GmbH, Dienerstrasse 12, 80331 München, Germany
Registergericht und -nummer: Hamburg, HRB 86891
Sitz der Gesellschaft: Hamburg
Geschäftsführer: Graham Law, Christine Elizabeth Flores
(Sorry; I'm legally required to add this exciting detail to emails. Bleh.)

On Tue, Oct 28, 2014 at 5:05 PM, Anne van Kesteren <annevk@annevk.nl> wrote:

> On Thu, Oct 23, 2014 at 5:06 PM, Anne van Kesteren <annevk@annevk.nl>
> wrote:
> > So I guess whether something is weakly authenticated should first be
> > exposed on a response. And then propagated by the navigate and run a
> > worker algorithms somehow for environment settings objects.
>
> I would prefer not using http://www.w3.org/TR/wsc-ui/ as a building
> block since it's not actively maintained. I think for now I'll just
> define a "TLS state" field which is "protected", "deprecated", or
> "none" and leave it up to implementers to pick between "protected" and
> "deprecated" (that seems to be current best practice :/) and then
> Mixed Content and co can build upon that.
>
>
> --
> https://annevankesteren.nl/
>