Slashdot Mirror
IETF Starts Work On Next-Generation HTTP Standards
alphadogg writes "With an eye towards updating the Web to better accommodate complex and bandwidth-hungry applications, the Internet Engineering Task Force has started work on the next generation of HTTP, the underlying protocol for the Web. The HTTP Strict Transport Security (HSTS), is a security protocol designed to protect Internet users from hijacking. The HSTS is an opt-in security enhancement whereby web sites signal browsers to always communicate with it over a secure connection. If the user is using a browser that complies with HSTS policy, the browser will automatically switch to a secure version of the site, using 'https' without any intervention of the user. 'It's official: We're working on HTTP/2.0,' wrote IETF Hypertext Transfer Protocol working group chair Mark Nottingham, in a Twitter message late Tuesday."
The summary seems a bit confused, like they've misinterpreted the proposed standardisation of HSTS and the beginning of work on HTTP 2.0 as the same thing.
The EFF has plugins for Chrome and Firefox to force HTTPS on as many sites as it can. Will be nice to have it formally in HTTP 2.0, but that feature is available for many sites with the plugin it seems.
Those only work while the user is on a non-man-in-the-middled connection. With HSTS, the user access the site once over a non-MITM connection, and then his browser remembers to always connect over HTTPS. Then later, the user attempts to access the site over a connection where a man-in-the-middle is running SSLstrip to try to force the user to connect unsecurely, but the user's browsers remembers to never accept unsecured connections to the site.
There's going to be push-back from corporations on this one unless they break it so it's insecure. Truly secure browser-to-server communication resistant to man in the middle attacks would mean IT can't record and document what information is being sent from employees' computers. Legal will put the kabosh on the use of any tech that prevents them from papering over their asses by saying they did everything possible to prevent transmission of confidential/proprietary data. Note: Everything in a corporation is considered confidential and proprietary, including "Hello, world."
Whatever they're planning will involve some manner of broken certificate issuing authorities, or some backdoor way so that an interested party can "legitimately" spy on the over the wire traffic. You can count on it: A truly secure communications medium is the one thing nobody with money wants to have in existance. It threatens so many (admitedly broken) business models... in fact there's an entire tech ecosystem built around the inherent insecurities of modern information infrastructure. They don't want it fixed: Broken = money. Fixed = broke.
#fuckbeta #iamslashdot #dicemustdie
Because the current solution of a problem is not necessarily the best and it may be possible to improve it.
signature is pants
It's official: We're working on HTTP/2.0,
Eh hem, people have been working on "HTTP 2.0" since HTTP/1.1 came out. Just ask Roy Fielding and others.
Not everything in this wide world can be represented as static state. There are lots of dynamic, parallel, and long-running actions happening all around us. It sure would be nice to trigger a processing operation with an EXECUTE verb because PUT and POST just don't make sense in that context.
Will this work in IE 6?
If IE 6 doesn't support it then I am not interested. We do not want to turn down .01% of our visitors as that would cost hundreds!! Now get your ass back to work spemnding thousands to support these hundred of dollars worth of users.
http://saveie6.com/
Isn't that what TLS is for?
Any for hardware standards? For example a GFX hardware interface? Any hope for an open GiGE like standard for cameras?
So, wouldn't a man-in-the-middle be able to intercept HSTS and turn it into plain HTTP?
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
Only if the browser has never seen the site before. If the browser has seen the site before and remembers it used HSTS last time, then it will expect HSTS+HTTPS to be used this time too and won't accept anything less.
Please, can HSTS also get an option to limit the acceptable certificates for a domain?
We have this:
- There have been multiple breaches of CAs already.
- Any CA can sign a certificate for any domain name
How about these options:
- parent: accept any certificate which is signed by a certificate given in the "HSTS" header and stored on the user system. Option to require a direct descendent.
- direct: specify just one allowable certificate.
- You can specify multiple alternative certificates in the "HSTS" headers.
If the parent or direct certificate expired and the browser didn't know about an alternative, it would fall back to accepting any valid certificate. Thus, people who forgot to update their "HSTS" headers wouldn't be SOL. There could be another flag to reject servers which didn't have any HSTS headers, even after all known certs expired.
Big companies could have an internal CA and require that as their parent. They would thus be completely immune to CA breaches. Small-time users could use the direct mode, and thus also be immune to all CA breaches. One could also set the CA root (e.g. VeriSign) as the parent, in which case they would be immune to all breaches except for the CA they chose, and it woudn't require intervention unless they change CA. My proposal should also work for self-signed certs, with the normal caveats.
Now where do I post my suggestion ? ;)
Maybe you should read the article. SPDY will be used as a base for HTTP2.0.
One side of me says "that sounds cool", but the other side says "what about other protocols?"
Why should HTTP be the only protocol that DNSSEC can flag? Why not any/all protocols that have been or will be created? Now we're talking about DNSSEC servers having to track a potentially infinite amount of protocols. That won't work.
While HTTP is a popular protocol, it should not get special treatment. The Internet should be protocol agnostic.
Because that isn't even remotely secure. Google 'sslstrip' -- it's not just theoretically possible to defeat such a system, it's been done and is actually quite trivial
Yes, a great mechanism, inform the user over a non-secure channel that he should use a secure channel from now on!
I'm sure there's no way to crack this HSTS, I mean, it's not like anyone would intercept the first communication; that's just unpolite, even for crackers!
You're right, I mean, imagine if you had to create special DNS entries for different services, like MX records for email, or SRV records for XMPP (and SIP and a few others)!!
Yes, if you are already compromised the FIRST time you access the site it doesn't help. So? When was the first time you accessed your bank site, Your web mail? Do you even remember? How often have you accessed them since? Securing every subsequent access is certainly an improvement over never securing them at all!
I would like to see Multiple CAs; I don't know this is possible now because I only ever saw 1 cert configs on my old server.
I'm less concerned with CA breaches than I am with con-men who often easily can buy CA certs. I think the local government should be a CA for every business that incorporates with them (have you seen the paper certificates they give? you could make them yourself, and the business ID numbers are not secure either...) It was harder to incorporate without showing a ton of legit identification than it was to get a cert from a cheap CA...
Democracy Now! - uncensored, anti-establishment news
The first time you access the website from that particular device, with that browser.
I accessed ALL my bank accounts last week from my work PC, and my new bank account last week from my home PC. (I don't use any webmail).
Securing N-1 is a lousy solution: an IETF standard should aim to secure 100%, not N-1.
Mod +1 Funny
That's exactly what SRV records are for. They first made MX records for email. Then they realized that other services need special records too, and added the service-independent SRV record.
Of all major operating systems, UNIX is the only one originally meant for gaming.