Slashdot Mirror

← Back to Stories (view on slashdot.org)

Most Alarming: IETF Draft Proposes "Trusted Proxy" In HTTP/2.0

Posted by timothy on from the you-have-reached-the-internet-mailbox-of-al-gore dept.

Lauren Weinstein writes "You'd think that with so many concerns these days about whether the likes of AT&T, Verizon, and other telecom companies can be trusted not to turn our data over to third parties whom we haven't authorized, that a plan to formalize a mechanism for ISP and other 'man-in-the-middle' snooping would be laughed off the Net. But apparently the authors of IETF (Internet Engineering Task Force) Internet-Draft 'Explicit Trusted Proxy in HTTP/2.0' (14 Feb 2014) haven't gotten the message. What they propose for the new HTTP/2.0 protocol is nothing short of officially sanctioned snooping."

2 of 177 comments (clear)

  1. Re:if you want a trusted proxy.. by the_B0fh · · Score: 5, Informative

    You don't understand how things work, do you? This bypasses your "acceptance" requirement.

    They can just do it transparently.

  2. Hidden problems with proxies by MobyDisk · · Score: 4, Informative

    My employer uses a MITM HTTPS proxy. The IT department pushed down a trusted corporate certificate, and most people don't even know their HTTPS connections aren't secure any more. The real problem is when some application, other than a browser, needs internet access and it fails. This includ sethings like web installers that download the app during installation, automatic update systems, secure file transfer software, or things that call home to confirm a license key. On occassion a developer curses some installer for not working, then we inspect the install.log file and find something about a certificate failure.

    IT departments forget that HTTPS is used for more than just browsing the web.