Re: Draft finding - "Transitioning the Web to HTTPS" from Paul Libbrecht on 2015-01-19 (www-tag@w3.org from January 2015)

From: Paul Libbrecht <paul@hoplahup.net>
Date: Mon, 19 Jan 2015 12:51:06 +0100
To: ht@inf.ed.ac.uk (Henry S. Thompson)
Cc: Mark Nottingham <mnot@mnot.net>, Henri Sivonen <hsivonen@hsivonen.fi>, Chris Palmer <palmer@google.com>, Noah Mendelsohn <nrm@arcanedomain.com>, "Michael\[tm\] Smith" <mike@w3.org>, Tim Berners-Lee <timbl@w3.org>, Public TAG List <www-tag@w3.org>
Message-Id: <0780A35E-5228-4BFB-BD86-DD63CC4845E3@hoplahup.net>

> The alternative an entity not a million miles away from my desk
> uses is to just self-sign and expect us to click through the resulting
> warnings. . .

My +1.
Please make browsers reasonably acting when contacting web-site that presents self-signed, expired, and other such certificates are used.
The crypto still happens, it's just less verified.

Paul

Received on Monday, 19 January 2015 11:51:46 UTC