[rtcweb] Traffic should be encrypted. (Re: Let's define the purpose of WebRTC)

[Harald Alvestrand <[e-mail]>]

On 11/10/2011 06:48 AM, Roman Shpount wrote:
>
> On Thu, Nov 10, 2011 at 12:20 AM, Eric Rescorla <[e-mail] 
> <mailto:[e-mail]>> wrote:
>
>     The point is that it's very hard to anticipate which
>     communications media
>     will be used for sensitive information. To say "we don't need security
>     in this application because nobody will ever use it to discuss
>     sensitive
>     stuff" is short-sighted. Better simply to be secure all the time.
>
>
> So why is 99% of the web traffic is HTTP? Do you want to force 
> everybody to use HTTPS? I think your argument is simply stating 
> encryption is good, no encryption bad, even if it is not needed or if 
> it does not protect anything (WebRTC application delivered over HTTP).

Since you asked....

Working, but not speaking, for the company that just decided that open 
Web search results should go over HTTPS: yes.

http://googleblog.blogspot.com/2011/10/making-search-more-secure.html

Having the default Web scheme be nonencrypted and nonsecured was a 
reasonable choice given the cost (and regulatory hassle) of crypto at 
that time. Long term, it was a mistake.

(BTW, Google searches did not immediately bring up verification for that 
claim of 99% of Web traffic being HTTP.... do you have a citation for that?)

                  Harald