Re: Draft finding - "Transitioning the Web to HTTPS"

HTTPS was undermined by Iranian agents (source: 2013 news re Dutch CA Diginortar) and you say that a protocol that's easy enough to undermine by a rogue 3rd world nation is something that the whole web should adopt?

Tim BL brought us the web. The TAG in this finding is bringing us a false sense of security. If I didn't know better I would say the TAG is intentionally breaking the web. The ground I already infested with ants and all you're doing with https-everywhere is covering the food with paper that has many holes. Eventually the ants will find their way. So instead of dealing with the problem at the source as Tim seems to suggest you want everyone to adopt a layer of protection that does not protect them in the hope that one day it will provide perfect security. This we know is not possible. So let's all add this layer of protection at some expense and inconvenience only to see it become a useless overhead. I would rather see us deal with the problem at the source and introducing laws that protect our human rights and punish those who break them. Adding a layer of expensive magic paint that has built in cracks and that can never provide a perfect seal is just contrary to intuition. Let's give engineers the tools to build advanced security models and let's encourage the proliferation of security models (or security thru obscurity) and let app developers and site owners decide what works for then and whether or not they even want to bother.

Wrong approach, TAG. Everything else, including the mess with shadow dom and custom elements, is forgivable. Adopting an already broken security standard on universal basis, and one that can never be made perfect and has already been abused with terrible consequence to those who trusted it, is not an acceptable approach. 

Sent from my iPhone

> On Jan 13, 2015, at 10:59 AM, Chris Palmer <palmer@google.com> wrote:
> 
>> On Tue, Jan 13, 2015 at 8:26 AM, Noah Mendelsohn <nrm@arcanedomain.com> wrote:
>> 
>> [1] http://www.w3.org/DesignIssues/NoSnooping.html
> 
> """This takes a lot of server CPU cycles, making server farms more
> expensive. It would slow the user's computer. It would effectively
> slow down the whole net."""
> 
> That was not true in 2009, and it's certainly not true now.
> 
> """It also prevents the use of HTTP proxies, which currently help the
> efficiency of web access."""
> 
> As discussed earlier in this thread, HTTPS requires clients to
> knowingly opt in to caching, transforming, or spying proxies. But such
> proxies are still possible. HTTPS makes them prove some value.
> 
> Overall, TBL seems to be saying that people shouldn't spy on the net,
> so that we can enjoy many social goods. Among those goods, he seems to
> place the ability to not have to adopt HTTPS. Unfortunately, we don't
> like in so innocent a world, and HTTPS is the bare minimum protection
> against tampering and spying.
>

Received on Wednesday, 14 January 2015 20:24:30 UTC