IETF Logo Mail Archive

Re: http2 opportunistic security negotiation

Patrick McManus <pmcmanus@mozilla.com> Tue, 10 February 2015 22:51 UTC

Return-Path: <ietf-http-wg-request+bounce-httpbisa-archive-bis2juki=lists.ietf.org@listhub.w3.org>
X-Original-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Delivered-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F12E01A874A for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Tue, 10 Feb 2015 14:51:36 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.289
X-Spam-Level:
X-Spam-Status: No, score=-6.289 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 54VL8vZWLhOV for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Tue, 10 Feb 2015 14:51:31 -0800 (PST)
Received: from frink.w3.org (frink.w3.org [128.30.52.56]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B15B81A8744 for <httpbisa-archive-bis2Juki@lists.ietf.org>; Tue, 10 Feb 2015 14:51:31 -0800 (PST)
Received: from lists by frink.w3.org with local (Exim 4.80) (envelope-from <ietf-http-wg-request@listhub.w3.org>) id 1YLJam-0006LI-MX for ietf-http-wg-dist@listhub.w3.org; Tue, 10 Feb 2015 22:47:40 +0000
Resent-Date: Tue, 10 Feb 2015 22:47:40 +0000
Resent-Message-Id: <E1YLJam-0006LI-MX@frink.w3.org>
Received: from maggie.w3.org ([128.30.52.39]) by frink.w3.org with esmtp (Exim 4.80) (envelope-from <pmcmanus@mozilla.com>) id 1YLJaf-0006KS-Bc for ietf-http-wg@listhub.w3.org; Tue, 10 Feb 2015 22:47:33 +0000
Received: from li629-102.members.linode.com ([192.155.95.102] helo=linode64.ducksong.com) by maggie.w3.org with esmtp (Exim 4.72) (envelope-from <pmcmanus@mozilla.com>) id 1YLJae-0005lW-7V for ietf-http-wg@w3.org; Tue, 10 Feb 2015 22:47:33 +0000
Received: from mail-qa0-f46.google.com (mail-qa0-f46.google.com [209.85.216.46]) by linode64.ducksong.com (Postfix) with ESMTPSA id 9A3303A01A for <ietf-http-wg@w3.org>; Tue, 10 Feb 2015 17:47:09 -0500 (EST)
Received: by mail-qa0-f46.google.com with SMTP id n4so8447313qaq.5 for <ietf-http-wg@w3.org>; Tue, 10 Feb 2015 14:47:09 -0800 (PST)
MIME-Version: 1.0
X-Received: by 10.224.151.69 with SMTP id b5mr45113932qaw.10.1423608429290; Tue, 10 Feb 2015 14:47:09 -0800 (PST)
Received: by 10.140.91.200 with HTTP; Tue, 10 Feb 2015 14:47:09 -0800 (PST)
In-Reply-To: <CAKC-DJhOm-4AqfvsdvTL1NBn1kauTBcsah8MBhushsS=5Ods=A@mail.gmail.com>
References: <CAKC-DJhOm-4AqfvsdvTL1NBn1kauTBcsah8MBhushsS=5Ods=A@mail.gmail.com>
Date: Tue, 10 Feb 2015 17:47:09 -0500
Message-ID: <CAOdDvNryHpJ=GR2GJn3pxcL+FRVDKLJSs38wYd5wFUvGy3x3Eg@mail.gmail.com>
From: Patrick McManus <pmcmanus@mozilla.com>
To: Erik Nygren <erik@nygren.org>
Cc: "ietf-http-wg@w3.org Group" <ietf-http-wg@w3.org>
Content-Type: multipart/alternative; boundary="089e0149ca44ba2e23050ec3aa67"
Received-SPF: neutral client-ip=192.155.95.102; envelope-from=pmcmanus@mozilla.com; helo=linode64.ducksong.com
X-W3C-Hub-Spam-Status: No, score=-3.6
X-W3C-Hub-Spam-Report: AWL=-2.500, BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_NEUTRAL=0.779, URIBL_BLOCKED=0.001
X-W3C-Scan-Sig: maggie.w3.org 1YLJae-0005lW-7V 0a17bb0c51fc638ec513964619ad9ad8
X-Original-To: ietf-http-wg@w3.org
Subject: Re: http2 opportunistic security negotiation
Archived-At: <http://www.w3.org/mid/CAOdDvNryHpJ=GR2GJn3pxcL+FRVDKLJSs38wYd5wFUvGy3x3Eg@mail.gmail.com>
Resent-From: ietf-http-wg@w3.org
X-Mailing-List: <ietf-http-wg@w3.org> archive/latest/28794
X-Loop: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list
List-Id: <ietf-http-wg.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Post: <mailto:ietf-http-wg@w3.org>
List-Unsubscribe: <mailto:ietf-http-wg-request@w3.org?subject=unsubscribe>

I might be under-thinking this one.... but it occurs to me its possible to
not put the tls version of the site on 443 if there is no https:// version
of the site.. oe doesn't require a particular port number and 443 seems
like the wrong choice if https:// isn't available. too simplistic?

On Thu, Feb 5, 2015 at 10:08 AM, Erik Nygren <erik@nygren.org> wrote:

> While digging further into server-side implementation details of the
> current opportunistic security draft, we identified a user experience
> problem.  In particular, for a site that has Virtual Hosts which are
> HTTP-only (ie, there is no valid certificate for them), there is no way in
> the current proposal to both support Opportunistic Security  (negotiate h2
> for http scheme over TLS without a necessarily valid certificate) without
> also giving users accidentally typing in https URIs a certificate mismatch
> interstitial they'd be prompted to click through.
>

v2.41.0 | Report a Bug | By Email | System Status