Re: Don't favour https ( LC-2382)

No complaints about the response.
However it might be helpful to show the diff between versions of the TLS-protected text.

Joe

On May 4, 2010, at 5:38 AM, Mary Ellen Zurko wrote:

Folks, here's is my draft reply to Krzysztof. Thoughts?
___________________________________________________

The working group remains in favor of the following text for several reasons:

[Definition: An HTTP transaction is strongly TLS-protected if it is TLS-protected<http://www.w3.org/2006/WSC/drafts/rec/rewrite.html#def-tls-protected>, an https URL was used, strong TLS algorithms<http://www.w3.org/2006/WSC/drafts/rec/rewrite.html#def-strong-algos> were negotiated for both confidentiality and integrity protection, and at least one of the following conditions is true:]

The first is that the specification deals with presentation and communication of web security context information to end users. Users are accustomed to the https: url, have been trained to look for it in many contexts, and would find it confusing to not find it in the presence of other security context indicators.

The second is that the scope of the specification is currently deployed best practice, and the implementation reports supporting the specification are based on the functionality in the web user agents reporting. The test cases they have used all include this definition.

The definition of TLS-protected is the only place in the specification where we explicitly talk about TLS upgrade for HTTP transactions.  Since we cannot actually claim implementation of this mechanism, we propose to remove it from the definition.  This should make it clear that TLS upgrade is out of scope to this specification, and also makes the specification more internally consistent.

[Definition: An HTTP transaction is TLS-protected if the resource was identified through a URI with the https URI scheme, the TLS handshake was performed successfully, and the HTTP transaction has occurred through the TLS channel.]