Slashdot Mirror
IETF Starts Work On Next-Generation HTTP Standards
alphadogg writes "With an eye towards updating the Web to better accommodate complex and bandwidth-hungry applications, the Internet Engineering Task Force has started work on the next generation of HTTP, the underlying protocol for the Web. The HTTP Strict Transport Security (HSTS), is a security protocol designed to protect Internet users from hijacking. The HSTS is an opt-in security enhancement whereby web sites signal browsers to always communicate with it over a secure connection. If the user is using a browser that complies with HSTS policy, the browser will automatically switch to a secure version of the site, using 'https' without any intervention of the user. 'It's official: We're working on HTTP/2.0,' wrote IETF Hypertext Transfer Protocol working group chair Mark Nottingham, in a Twitter message late Tuesday."
Maybe I'm stupid, but we already do this with rewrites and/or irules pretty much everywhere.
How long will it be before it's adopted? HTTP/2.0 is pretty badly needed already. If they're going to get the standard out by 2014...
The summary seems a bit confused, like they've misinterpreted the proposed standardisation of HSTS and the beginning of work on HTTP 2.0 as the same thing.
The EFF has plugins for Chrome and Firefox to force HTTPS on as many sites as it can. Will be nice to have it formally in HTTP 2.0, but that feature is available for many sites with the plugin it seems.
Really REALLY hard.
I joke. But seriously, why add more code to a solved problem?
Also, slashdot, you track my karma down to terrible, so I can only post twice a day ... so then I just logout and post to my hearts content and its harder for others to block me, thats pretty dumb don't you think? Seems like you'd be better off letting me post logged in so people could know they don't want to read my posts in advance.
--BitZtream
Passing
There's going to be push-back from corporations on this one unless they break it so it's insecure. Truly secure browser-to-server communication resistant to man in the middle attacks would mean IT can't record and document what information is being sent from employees' computers. Legal will put the kabosh on the use of any tech that prevents them from papering over their asses by saying they did everything possible to prevent transmission of confidential/proprietary data. Note: Everything in a corporation is considered confidential and proprietary, including "Hello, world."
Whatever they're planning will involve some manner of broken certificate issuing authorities, or some backdoor way so that an interested party can "legitimately" spy on the over the wire traffic. You can count on it: A truly secure communications medium is the one thing nobody with money wants to have in existance. It threatens so many (admitedly broken) business models... in fact there's an entire tech ecosystem built around the inherent insecurities of modern information infrastructure. They don't want it fixed: Broken = money. Fixed = broke.
#fuckbeta #iamslashdot #dicemustdie
Summary is horrible. Goes from HTTP 2.0 to HSTS back to HTTP 2.0 without really explaining the link between the two.
It's official: We're working on HTTP/2.0,
Eh hem, people have been working on "HTTP 2.0" since HTTP/1.1 came out. Just ask Roy Fielding and others.
Not everything in this wide world can be represented as static state. There are lots of dynamic, parallel, and long-running actions happening all around us. It sure would be nice to trigger a processing operation with an EXECUTE verb because PUT and POST just don't make sense in that context.
There's going to be push-back from corporations on this one unless they break it so it's insecure. Truly secure browser-to-server communication resistant to man in the middle attacks would mean IT can't record and document what information is being sent from employees' computers.
You really haven't put any thought into this.
... do 10 seconds of homework next time please ... they control the computer AND the network. You could log the data as the user is viewing it. That could be simple as a screen scraper or a modified browser or it could be something more exotic. There are always ways to do things and there is certainly a market for this at the enterprise level. If you really can't be bothered to Google a topic because ya gotta get that post fast as you can at least take a moment to consider other ways to do the same thing.
Even if automated legitimate MITM of SSL connections WEREN'T already commonplace in corporations... and they are
Mods, I know she tried and everything but FACTUALLY FALSE INFORMATION does not deserve a +5. Please correct this.
This is not secure as long as anyone can sign their own certificates or become a certificate authority. Anyone can sign a certificate and make it look official without the end user knowing any better. Furthermore, companies like Verisign have been hacked often, likely allowing rogue certificates to be issued with the appearance they were signed legitimately. If this is going to be secure, only trusted companies like Microsoft should be permitted to sign certificates, so that sites using these secure protocols can really be trusted.
AH ahhahahahahaha that was pretty good. You made an effort to sound reasonable for a while there. You had me going right up until I read "Microsoft".
This was a harmless humorous troll. Well done! Sadly they don't appreciate such things here. They get butthurt and mod you down.
Why do we need a new protocol?
What's so hard for a webserver to check if a connection is over HTTP then redirect the user to the HTTPS version ?
the IETF are starting to sound like a govenment
and surely the first worm to hit the internet after this is implemented is going to turn that flag on for every small website that doesn't support HTTPS thereby making the website look like its down ?
Will this work in IE 6?
If IE 6 doesn't support it then I am not interested. We do not want to turn down .01% of our visitors as that would cost hundreds!! Now get your ass back to work spemnding thousands to support these hundred of dollars worth of users.
http://saveie6.com/
Face it, SFTP would be a better candidate, and already exists.
By the time it's ready, we'll be on web 8.0.
Isn't that what TLS is for?
Any for hardware standards? For example a GFX hardware interface? Any hope for an open GiGE like standard for cameras?
Does that make the IETF the HTTP Strict Transport Security... Administration? They protect Internet users from "hijacking"? It all fits! They're evil, I say!
Please, can HSTS also get an option to limit the acceptable certificates for a domain?
We have this:
- There have been multiple breaches of CAs already.
- Any CA can sign a certificate for any domain name
How about these options:
- parent: accept any certificate which is signed by a certificate given in the "HSTS" header and stored on the user system. Option to require a direct descendent.
- direct: specify just one allowable certificate.
- You can specify multiple alternative certificates in the "HSTS" headers.
If the parent or direct certificate expired and the browser didn't know about an alternative, it would fall back to accepting any valid certificate. Thus, people who forgot to update their "HSTS" headers wouldn't be SOL. There could be another flag to reject servers which didn't have any HSTS headers, even after all known certs expired.
Big companies could have an internal CA and require that as their parent. They would thus be completely immune to CA breaches. Small-time users could use the direct mode, and thus also be immune to all CA breaches. One could also set the CA root (e.g. VeriSign) as the parent, in which case they would be immune to all breaches except for the CA they chose, and it woudn't require intervention unless they change CA. My proposal should also work for self-signed certs, with the normal caveats.
Now where do I post my suggestion ? ;)
Google already have the next HTTP - and it may well be better!
http://en.wikipedia.org/wiki/SPDY
you are now safe.
I would like to see Multiple CAs; I don't know this is possible now because I only ever saw 1 cert configs on my old server.
I'm less concerned with CA breaches than I am with con-men who often easily can buy CA certs. I think the local government should be a CA for every business that incorporates with them (have you seen the paper certificates they give? you could make them yourself, and the business ID numbers are not secure either...) It was harder to incorporate without showing a ton of legit identification than it was to get a cert from a cheap CA...
Democracy Now! - uncensored, anti-establishment news
We don't need another new set of HTTP standards.
What we need is for someone to finish implementing the standard we already have today.
Everything out there today, is a half-assed unfinished work.
At HOPE (Hackers On Planet Earth) # 9 this year, Adam Langley (from Google) gave a very interesting talk about HSTS/HTTPS called "The state of HTTPS". If you're not quite understanding what HSTS is, check out his video at:
http://www.youtube.com/watch?v=LBbCec4Bp10
It covers a lot of comments/questions that have been posted about this topic. It's a very good/interesting talk.
HSTS and HTTP/2 are separate things.
HTTP/2 is starting out from SPDY's draft-2 where all the current implementations use SSL, true, but there is no link at all to HSTS.
Mod +1 Funny
I'm glad someone has finally implemented a new protocol to perform the same action that a permanent redirect does. It's so hard to remember what "301" means.
What if IETF would convene one day and say, "well, it's been a pretty good year -- you know, so many of these protocol recommendations have turned out to be major fiascoes or corporate migration nightmares or browser incompatibility quagmires or loopholes into new penis pump pusher cross site scripting attacks... so many, oh dear..."
"So... we recommend that everyone leave things in the HTTP protocol just as they are."
"So we can all concentrate on improving our lives in other ways. Have a great year!"
[gasp of relief]
[thunderous applause, with tears and laughter]
Except for anything Microsoft wants. That must go through. Windows 10 is just around the corner!