SoylentNews

Pseudo HTTPS Proposed

posted by Dopefish on Monday February 24 2014, @06:00PM   
from the things-could-get-hairy dept.

mrbluze writes:

"A modified HTTP protocol is being proposed (the proposal is funded by AT&T) which would allow ISP's to decrypt and re-encrypt traffic as part of day to day functioning in order to save money on bandwidth through caching. The draft document states:

To distinguish between an HTTP2 connection meant to transport "https" URIs resources and an HTTP2 connection meant to transport "http" URIs resource, the draft proposes to 'register a new value in the Application Layer Protocol negotiation (ALPN) Protocol IDs registry specific to signal the usage of HTTP2 to transport "http" URIs resources: h2clr.

The proposal is being criticized by Lauren Weinstein in that it provides a false sense of security to end users who might believe that their communications are actually secure. Can this provide an ISP with an excuse to block or throttle HTTPS traffic?"

• Re:It's a Good Idea Worthy of Our SupportRe:It's a Good Idea Worthy of Our Support (Score: 1) by calmond on Tuesday February 25 2014, @07:17PM

  by calmond (1826) on Tuesday February 25 2014, @07:17PM (#6851)

  I guess I should clarify a bit what I had in mind. Certainly client utilities like Browse Control and others can work on the client in an all HTTPS environment. I've set up transparent proxies in the past though to catch all client machines (tablets, smart phones, etc.), including those that may not have a client application installed. An all HTTPS environment would render transparent proxies, and thus mandatory filtering of all network traffic in places like K-12 schools, impossible. Naturally, a school could simply deny access to devices they don't own, and solve that problem.

  Having said all that, please don't misunderstand me, I am completely in favor of an all HTTPS protocol, I'm just pointing out that any such move will have consequences.

  Parent

• Re:It's a Good Idea Worthy of Our SupportRe:It's a Good Idea Worthy of Our Support (Score: 2) by dmc on Wednesday February 26 2014, @02:47AM

  by dmc (188) on Wednesday February 26 2014, @02:47AM (#7077)

  An all HTTPS environment would render transparent proxies, and thus mandatory filtering of all network traffic in places like K-12 schools, impossible. Naturally, a school could simply deny access to devices they don't own, and solve that problem.

  I think you just contradicted yourself. You went from impossible, to naturally problem solved in the space of two sentences.

  Parent

  • Re:It's a Good Idea Worthy of Our Support(Score: 1) by calmond on Wednesday February 26 2014, @02:02PM

    by calmond (1826) on Wednesday February 26 2014, @02:02PM (#7276)

    No, not really. I said it is impossible to do this from a centralized server environment for all devices. A compromise would be to not allow all devices, but only the ones under your administrative control. This is not a contradiction, but a compromise.

    Parent