Re: [hybi] On TLS-only Approaches

[Adam Barth <[e-mail]>]

On Sun, Aug 22, 2010 at 8:47 PM, Maciej Stachowiak <[e-mail]> wrote:
> 3) I would guess the challenge for embedded devices that *do* want to
> provide WebSocket services is that they can't practically ship with a valid
> certificate. To address this without creating security holes, we would
> likely need two URI schemes (ws: and wss:) with two different NPN protocol
> identifiers. ws: would not require a valid cert, wss: would. The reason two
> different NPN protocol identifiers are required is to prevent
> man-in-the-middle attacks against wss: services accessed using ws: by making
> it impossible to access them via ws:.

Yeah, I agree that we'll probably still want two security levels, one
that resists active network attackers and one that doesn't.

Adam