Re: Proposed Statement on "HTTPS everywhere for the IETF"

[Paul Wouters <[e-mail]>]

On Mon, 1 Jun 2015, Niels Dettenbach wrote:

> - And: there ARE poeples and services which doen't allow encrypted access for
> legal or organisational reasons - it would not be nice to block interested
> poeples from such user "societies" which are not usually free to decide for an
> alternative byself.

And that resoning is exactly how we _got_ into this mess in the first
place. We had to cater to governments banning encryption for its users,
and we now see what that got them. I can no longer prevent goverments
interpreting my online self based on 20 years of data, but I sure hope
we can prevent that for future generations. We should have said no to
governments in the previous crypto war - and we definitely have to say
no now.

Enterprise users are no problem, they have enterprise-issued local policy
and can override all the TLS they want with MITM certs and proxies and
mandated software on the enterprise hardware.

> And for me personal: I use a 7 year old cell phone to read http stuff in my
> spare time and do not understand why i should buy a new one for the very same
> application.

A cell phone that cannot do SSL/TLS (or worse, 7 year old SSL only) is
a danger to its owner and possibly to the internet at large if it is
owned by botnets already.

Paul