SoylentNews

Pseudo HTTPS Proposed

posted by Dopefish on Monday February 24 2014, @06:00PM   
from the things-could-get-hairy dept.

mrbluze writes:

"A modified HTTP protocol is being proposed (the proposal is funded by AT&T) which would allow ISP's to decrypt and re-encrypt traffic as part of day to day functioning in order to save money on bandwidth through caching. The draft document states:

To distinguish between an HTTP2 connection meant to transport "https" URIs resources and an HTTP2 connection meant to transport "http" URIs resource, the draft proposes to 'register a new value in the Application Layer Protocol negotiation (ALPN) Protocol IDs registry specific to signal the usage of HTTP2 to transport "http" URIs resources: h2clr.

The proposal is being criticized by Lauren Weinstein in that it provides a false sense of security to end users who might believe that their communications are actually secure. Can this provide an ISP with an excuse to block or throttle HTTPS traffic?"

• Re:It's a Good Idea Worthy of Our Support (Score: 5, Insightful) by frojack on Monday February 24 2014, @07:23PM

  by frojack (1554) on Monday February 24 2014, @07:23PM (#6079) Journal

  Then the problem is Netflix, and not a few tiny gifs and logos that the ISP can avoid fetching. This will save exactly nothing.

  Netflix is best fixed by moving content to the ISPs network (which is exactly what they are doing), not by futzing around with the other traffic.

  --
  No, you are mistaken. I've always had this sig.

  Parent

  Starting Score:	1		point
  Moderation		+4
  Insightful=3, Informative=1, Total=4
  Extra 'Insightful' Modifier		0
  Karma-Bonus Modifier		+1
  Total Score:		5