Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I don't think every connection is TLS.

This is obviously a critical mistake, given HTTPS stripping is possibly the biggest weakness in current web transport security.



There have been several debates about making TLS mandatory in HTTP 2.0 on the ietf-http-wg mailing list. Here's a link to a NetFlix engineer's comment in the most recent one I could find:

http://lists.w3.org/Archives/Public/ietf-http-wg/2012JulSep/...

In short: While TLS is a really good idea for just about every user-facing site on the web, there are many applications where some combination of the administrative burden, need for intermediaries and performance cost make TLS sufficiently undesirable to preclude adoption of a spec that required it.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: