Resent-Date: Tue, 10 Feb 2015 22:47:40 +0000
Resent-Message-Id: <E1YLJam-0006LI-MX@frink.w3.org>
MIME-Version: 1.0
In-Reply-To: <CAKC-DJhOm-4AqfvsdvTL1NBn1kauTBcsah8MBhushsS=5Ods=A@mail.gmail.com>
References: <CAKC-DJhOm-4AqfvsdvTL1NBn1kauTBcsah8MBhushsS=5Ods=A@mail.gmail.com>
Date: Tue, 10 Feb 2015 17:47:09 -0500
Message-ID: <CAOdDvNryHpJ=GR2GJn3pxcL+FRVDKLJSs38wYd5wFUvGy3x3Eg@mail.gmail.com>
From: Patrick McManus <pmcmanus@mozilla.com>
To: Erik Nygren <erik@nygren.org>
Cc: "ietf-http-wg@w3.org Group" <ietf-http-wg@w3.org>
Content-Type: multipart/alternative; boundary=089e0149ca44ba2e23050ec3aa67
Received-SPF: neutral client-ip=192.155.95.102;
 envelope-from=pmcmanus@mozilla.com; helo=linode64.ducksong.com
Subject: Re: http2 opportunistic security negotiation
Archived-At: <http://www.w3.org/mid/CAOdDvNryHpJ=GR2GJn3pxcL+FRVDKLJSs38wYd5wFUvGy3x3Eg@mail.gmail.com>
Resent-From: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list

--089e0149ca44ba2e23050ec3aa67
Content-Type: text/plain; charset=UTF-8

I might be under-thinking this one.... but it occurs to me its possible to
not put the tls version of the site on 443 if there is no https:// version
of the site.. oe doesn't require a particular port number and 443 seems
like the wrong choice if https:// isn't available. too simplistic?

On Thu, Feb 5, 2015 at 10:08 AM, Erik Nygren <erik@nygren.org> wrote:

> While digging further into server-side implementation details of the
> current opportunistic security draft, we identified a user experience
> problem.  In particular, for a site that has Virtual Hosts which are
> HTTP-only (ie, there is no valid certificate for them), there is no way in
> the current proposal to both support Opportunistic Security  (negotiate h2
> for http scheme over TLS without a necessarily valid certificate) without
> also giving users accidentally typing in https URIs a certificate mismatch
> interstitial they'd be prompted to click through.
>

--089e0149ca44ba2e23050ec3aa67
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">I might be under-thinking this one.... but it occurs to me=
 its possible to not put the tls version of the site on 443 if there is no =
https:// version of the site.. oe doesn&#39;t require a particular port num=
ber and 443 seems like the wrong choice if https:// isn&#39;t available. to=
o simplistic?<br><div><div class=3D"gmail_extra"><br><div class=3D"gmail_qu=
ote">On Thu, Feb 5, 2015 at 10:08 AM, Erik Nygren <span dir=3D"ltr">&lt;<a =
href=3D"mailto:erik@nygren.org" target=3D"_blank">erik@nygren.org</a>&gt;</=
span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0=
px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir=
=3D"ltr"><div><div><div><div><div><div><div><div>While digging further into=
 server-side implementation details of the current opportunistic security d=
raft, we identified a user experience problem.=C2=A0 In particular, for a s=
ite that has Virtual Hosts which are HTTP-only (ie, there is no valid certi=
ficate for them), there is no way in the current proposal to both support O=
pportunistic Security=C2=A0 (negotiate h2 for http scheme over TLS without =
a necessarily valid certificate) without also giving users accidentally typ=
ing in https URIs a certificate mismatch interstitial they&#39;d be prompte=
d to click through.<br></div></div></div></div></div></div></div></div></di=
v></blockquote><div><br>=C2=A0</div></div></div></div></div>

--089e0149ca44ba2e23050ec3aa67--