Slashdot Mirror
IETF Starts Work On Next-Generation HTTP Standards
alphadogg writes "With an eye towards updating the Web to better accommodate complex and bandwidth-hungry applications, the Internet Engineering Task Force has started work on the next generation of HTTP, the underlying protocol for the Web. The HTTP Strict Transport Security (HSTS), is a security protocol designed to protect Internet users from hijacking. The HSTS is an opt-in security enhancement whereby web sites signal browsers to always communicate with it over a secure connection. If the user is using a browser that complies with HSTS policy, the browser will automatically switch to a secure version of the site, using 'https' without any intervention of the user. 'It's official: We're working on HTTP/2.0,' wrote IETF Hypertext Transfer Protocol working group chair Mark Nottingham, in a Twitter message late Tuesday."
The EFF has plugins for Chrome and Firefox to force HTTPS on as many sites as it can. Will be nice to have it formally in HTTP 2.0, but that feature is available for many sites with the plugin it seems.
Those only work while the user is on a non-man-in-the-middled connection. With HSTS, the user access the site once over a non-MITM connection, and then his browser remembers to always connect over HTTPS. Then later, the user attempts to access the site over a connection where a man-in-the-middle is running SSLstrip to try to force the user to connect unsecurely, but the user's browsers remembers to never accept unsecured connections to the site.
There's going to be push-back from corporations on this one unless they break it so it's insecure. Truly secure browser-to-server communication resistant to man in the middle attacks would mean IT can't record and document what information is being sent from employees' computers. Legal will put the kabosh on the use of any tech that prevents them from papering over their asses by saying they did everything possible to prevent transmission of confidential/proprietary data. Note: Everything in a corporation is considered confidential and proprietary, including "Hello, world."
Whatever they're planning will involve some manner of broken certificate issuing authorities, or some backdoor way so that an interested party can "legitimately" spy on the over the wire traffic. You can count on it: A truly secure communications medium is the one thing nobody with money wants to have in existance. It threatens so many (admitedly broken) business models... in fact there's an entire tech ecosystem built around the inherent insecurities of modern information infrastructure. They don't want it fixed: Broken = money. Fixed = broke.
#fuckbeta #iamslashdot #dicemustdie
Because the current solution of a problem is not necessarily the best and it may be possible to improve it.
signature is pants
Right? I had to read it a few times to make sense of it. I'm still not quite clear on what HSTS has to do with HTTP/2.0...
"Ignorance more frequently begets confidence than does knowledge"
- Charles Darwin
Not everything in this wide world can be represented as static state. There are lots of dynamic, parallel, and long-running actions happening all around us. It sure would be nice to trigger a processing operation with an EXECUTE verb because PUT and POST just don't make sense in that context.
Please, can HSTS also get an option to limit the acceptable certificates for a domain?
We have this:
- There have been multiple breaches of CAs already.
- Any CA can sign a certificate for any domain name
How about these options:
- parent: accept any certificate which is signed by a certificate given in the "HSTS" header and stored on the user system. Option to require a direct descendent.
- direct: specify just one allowable certificate.
- You can specify multiple alternative certificates in the "HSTS" headers.
If the parent or direct certificate expired and the browser didn't know about an alternative, it would fall back to accepting any valid certificate. Thus, people who forgot to update their "HSTS" headers wouldn't be SOL. There could be another flag to reject servers which didn't have any HSTS headers, even after all known certs expired.
Big companies could have an internal CA and require that as their parent. They would thus be completely immune to CA breaches. Small-time users could use the direct mode, and thus also be immune to all CA breaches. One could also set the CA root (e.g. VeriSign) as the parent, in which case they would be immune to all breaches except for the CA they chose, and it woudn't require intervention unless they change CA. My proposal should also work for self-signed certs, with the normal caveats.
Now where do I post my suggestion ? ;)
One side of me says "that sounds cool", but the other side says "what about other protocols?"
Why should HTTP be the only protocol that DNSSEC can flag? Why not any/all protocols that have been or will be created? Now we're talking about DNSSEC servers having to track a potentially infinite amount of protocols. That won't work.
While HTTP is a popular protocol, it should not get special treatment. The Internet should be protocol agnostic.
I would like to see Multiple CAs; I don't know this is possible now because I only ever saw 1 cert configs on my old server.
I'm less concerned with CA breaches than I am with con-men who often easily can buy CA certs. I think the local government should be a CA for every business that incorporates with them (have you seen the paper certificates they give? you could make them yourself, and the business ID numbers are not secure either...) It was harder to incorporate without showing a ton of legit identification than it was to get a cert from a cheap CA...
Democracy Now! - uncensored, anti-establishment news