RE: HTTP/2 and Pervasive Monitoring

"Albert Lunde" <atlunde@panix.com> Fri, 15 August 2014 13:11 UTC

Resent-Date: Fri, 15 Aug 2014 13:08:49 +0000
Resent-Message-Id: <E1XIHFR-0003oZ-Sj@frink.w3.org>
From: Albert Lunde <atlunde@panix.com>
To: ietf-http-wg@w3.org
References: <38BD57DB-98A9-4282-82DD-BB89F11F7C84@mnot.net> <4851.1408094168@critter.freebsd.dk> <EB5B7C64-165B-48F1-94FF-1354E917A10F@mnot.net> <op.xkmwanaliw9drz@riaa>
In-Reply-To: <op.xkmwanaliw9drz@riaa>
Date: Fri, 15 Aug 2014 08:08:08 -0500
Message-ID: <01c101cfb889$f7814bf0$e683e3d0$@panix.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Thread-Index: AQIv2mc5aOTP1P3/x50/UwgDJ0ZP/AH3xH5hAiVIKM8CGTbOjprfq0DQ
Content-Language: en-us
Received-SPF: pass client-ip=166.84.1.89; envelope-from=atlunde@panix.com; helo=mailbackend.panix.com
Subject: RE: HTTP/2 and Pervasive Monitoring
Archived-At: <http://www.w3.org/mid/01c101cfb889$f7814bf0$e683e3d0$@panix.com>
Resent-From: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list

>What you can do in an MITM scenario isn't really relevant to PM. It's still harder to MITM weak TLS than clear text.
>
>I think it is more worrisome having the weak ciphers in there at all, as it opens up for bad configurations and downgrade attacks of https connections.

Outside the realm of standards, the print edition of "Bulletproof SSL and TLS: Understanding and Deploying SSL/TLS and PKI to Secure Servers and Web Applications" by Ivan Ristic just shipped(as in I expect to get a copy from Amazon later today) The chapter on OpenSSL has been available for a while, and helped me with some recent issues.

HTTP/2 and Pervasive Monitoring Mark Nottingham
Re: HTTP/2 and Pervasive Monitoring Amos Jeffries
Re: HTTP/2 and Pervasive Monitoring Greg Wilkins
RE: HTTP/2 and Pervasive Monitoring K.Morgan
Re: HTTP/2 and Pervasive Monitoring Poul-Henning Kamp
Re: HTTP/2 and Pervasive Monitoring Mark Nottingham
Re: HTTP/2 and Pervasive Monitoring Mark Nottingham
Re: HTTP/2 and Pervasive Monitoring Eliot Lear
Re: HTTP/2 and Pervasive Monitoring Poul-Henning Kamp
Re: HTTP/2 and Pervasive Monitoring Martin Nilsson
Re: HTTP/2 and Pervasive Monitoring Poul-Henning Kamp
RE: HTTP/2 and Pervasive Monitoring Albert Lunde
Re: HTTP/2 and Pervasive Monitoring Cory Benfield
Re: HTTP/2 and Pervasive Monitoring Erik Nygren
Re: HTTP/2 and Pervasive Monitoring Poul-Henning Kamp
Re: HTTP/2 and Pervasive Monitoring Roland Zink
Re: HTTP/2 and Pervasive Monitoring Martin Thomson
Re: HTTP/2 and Pervasive Monitoring Brian Smith
Re: HTTP/2 and Pervasive Monitoring Poul-Henning Kamp
Re: HTTP/2 and Pervasive Monitoring Eliot Lear
Re: HTTP/2 and Pervasive Monitoring Greg Wilkins
Re: HTTP/2 and Pervasive Monitoring Greg Wilkins
Re: HTTP/2 and Pervasive Monitoring Poul-Henning Kamp
Re: HTTP/2 and Pervasive Monitoring Stephen Farrell
Re: HTTP/2 and Pervasive Monitoring Poul-Henning Kamp
Re: HTTP/2 and Pervasive Monitoring Roland Zink
Re: HTTP/2 and Pervasive Monitoring Stephen Farrell
Re: HTTP/2 and Pervasive Monitoring Amos Jeffries
Re: HTTP/2 and Pervasive Monitoring Eliot Lear
Re: HTTP/2 and Pervasive Monitoring Poul-Henning Kamp
Re: HTTP/2 and Pervasive Monitoring Poul-Henning Kamp
Re: HTTP/2 and Pervasive Monitoring Ilari Liusvaara
Re: HTTP/2 and Pervasive Monitoring Mark Nottingham
Re: HTTP/2 and Pervasive Monitoring Greg Wilkins
Re: HTTP/2 and Pervasive Monitoring Poul-Henning Kamp
Re: HTTP/2 and Pervasive Monitoring Martin Thomson
Re: HTTP/2 and Pervasive Monitoring Poul-Henning Kamp
Re: HTTP/2 and Pervasive Monitoring Martin Thomson
Re: HTTP/2 and Pervasive Monitoring Poul-Henning Kamp