Subject: HTTP/2 - Unintended consequences of pseudo-mandatory TLS

From: Phil Lello <[email-masked]>
Date: Sun, 13 Mar 2016 20:17:54 +0000

Dear all,

Whilst I'm not certain that this is the right forum to address browser
support for h2c / non-TLS HTTP/2, I'd like to state my concerns over the de
facto requirement for TLS.

Whilst the aims of the "SSL everywhere" movement seem reasonable, I'm
unconvinced. I'm concerned that in practice, it will make the web less
secure whilst creating the illusion of security.

In many parts of the western world, bandwidth exists in sufficient
quantities for local caching to be overlooked as concern, but it certainly
isn't universal - indeed, reliable connectivity is an issue in some
locations, and a caching proxy is an appealing solution.

TLS proxies already exist that can be used to mitigate this, provided
someone is willing to install a root CA to accept re-signed content. Some
corporate desktops do this as part of a standard build. Forcing TLS on web
users will encourage this practice.

There will also be cases where in lieu of installing a root CA, users will
become accustomed to accepting self-signed or suspicious certificates,
potentially to a level where it becomes automatic even for sites that
really shouldn't have this issue.

There's a psychological impact to churning out the message that "this site
is secure" - it predisposes users to think that if they can see a secure
padlock/green tick/whatever then they don't need to concern themselves with
what information they're sharing, and why - legitimate sites can be hacked,
less reputable ones can get SSL certificates, and if there isn't at least
one intelligence agency or organised crime cartel that has a copy of a real
root CA cert, then I'm a teapot.
Regards,

Phil Lello

---

From: Willy Tarreau <[email-masked]>
Date: Sun, 13 Mar 2016 23:41:04 +0100

Hi Phil,

> root CA cert, then I'm a teapot.

That's what I've been saying as well during these discussions about TLS vs
non-TLS. I must say that I don't trust a TLS connection anymore from a
browser that I have not installed myself, TLS decryption is fairly common
nowadays and the user has no more choice but to accept the security he's
being offered.

And considering that some mobile phone operators are selling smartphones,
I'd be curious to know whether or not these phones are preloaded with extra
certs...

Regards,
Willy

---

From: Daniel Stenberg <[email-masked]>
Date: Sun, 13 Mar 2016 23:56:48 +0100 (CET)

> facto requirement for TLS.

Most of the things that can be said about this subject were iterated about 14 
times each in the "SSL/TLS everywhere fail" discussion in December:

https://lists.w3.org/Archives/Public/ietf-http-wg/2015OctDec/thread.html#msg313

-- 

  / daniel.haxx.se

---

From: Mark Nottingham <[email-masked]>
Date: Mon, 14 Mar 2016 10:06:51 +1100

Thanks, Daniel. 

Phil, we had a pretty extensive discussion about this, and as a WG decided not to require TLS for HTTP/2. 

I'm sympathetic to the need for a forum for such discussions -- and it's pretty clear that they're far from over -- but this isn't relevant to our current work. 

Cheers,

> On 14 Mar 2016, at 9:56 AM, Daniel Stenberg <[email-masked]> wrote:
> 
>> Whilst I'm not certain that this is the right forum to address browser support for h2c / non-TLS HTTP/2, I'd like to state my concerns over the de facto requirement for TLS.
> 
> Most of the things that can be said about this subject were iterated about 14 times each in the "SSL/TLS everywhere fail" discussion in December:
> 

--
Mark Nottingham   https://www.mnot.net/

---

From: "Poul-Henning Kamp" <[email-masked]>
Date: Mon, 14 Mar 2016 07:26:31 +0000

--------

>I'd be curious to know whether or not these phones are preloaded with extra

Mostly out of curiosity I bought a BlackPhone2 which is being aggresively
marketed as "Designed for Privacy".

It transpires that it isn't, but the point where I broke down laughing
was when I came to the cert I just had to screenshot for my review:

	http://www.version2.dk/blog/blackphone2-review-2-545078

-- 
Poul-Henning Kamp       | UNIX since Zilog Zeus 3.20
[email-masked]         | TCP/IP since RFC 956
FreeBSD committer       | BSD since 4.3-tahoe    
Never attribute to malice what can adequately be explained by incompetence.