I think this spec would be well-served to have an explicit "Goals" section in the introduction describing exactly what can be accomplished and how it compares feature-wise to HSTS. When and why would I use this vs. HSTS? (e.g. I still want to offer an HTTP option, but don't want users who choose HTTPS to have mixed content warnings, or I want to avoid mixed content from third-parties if they offer their resources securely, etc.) There is some of this in the introduction, but I think for FPWD it is important to be very clear about goals for an initial community review - especially since this is new work not explicitly listed in our proposed charter. -Brad On Tue Feb 10 2015 at 10:57:31 AM Jim Manico <jim.manico@owasp.org> wrote: > > That there should be a “strict” mode e.g. for banks that want absolutely > all traffic encrypted, and a “slack” mode e.g. for mashup web sites that > want to encrypt all of their own content, but not that coming from some > other web sites that they are pulling from. > > > Slack makes no sense to me; if the adversarial observer on your > network sees part of the page loaded via HTTP they can inject their > own content and game over. You are either all HTTPS or not HTTPS, > right? > > -- > Jim Manico > @Manicode > (808) 652-3805 > > > On Feb 10, 2015, at 7:12 PM, Crispin Cowan <crispin@microsoft.com> > wrote: > > > > That there should be a “strict” mode e.g. for banks that want absolutely > all traffic encrypted, and a “slack” mode e.g. for mashup web sites that > want to encrypt all of their own content, but not that coming from some > other web sites that they are pulling from. >
Received on Tuesday, 10 February 2015 19:08:22 UTC