Re: [TLS] Security concerns around co-locating TLS and non-secure on same port (WGLC: draft-ietf-tsvwg-iana-ports-08)

[Marsh Ray <[e-mail]>]

On 11/08/2010 05:30 PM, Nicolas Williams wrote:
>
> But ports are a limited commodity.

> So what you propose is... what exactly?  That every application protocol
> have raw TLS and non-TLS (but with StartTLS?) ports?  Or that every
> application be based on HTTP(S)?
>
> I'm proposing this: stop the FUD regarding StartTLS, bake it into all
> new app protocols where TLS is appropriate.  In existing apps that have
> both raw TLS and non-TLS ports, leave well enough alone.

Are people actually making that many new app protocols not based on TCP 
port 443?

It seems like the general trend is to run all new things over TCP 443 
whether it fits the HTTP 'web services' model or not. Because, 
ironically, everything else is more likely to be "managed" out of 
existence by the firewall admin. :-)

Microsoft, for example, has that VPN protocol that transparently 
multiplexes on that port. There's also the "next protocol notification" 
proposal being circulated.

- Marsh