In any case, why should I be forced to support a model where I have to beg for permission to host anything. I believe in stating my opinions and let others make up their own mind. The opposition believes in forcing everyone to adopt their position by fiat. Why not put the information out there, and let people switch to HTTPS if they feel like the benfits make sense to them.
And that's why chrome will mark your site as insecure.
> why should I be forced to [..] beg for permission [..]
That seems to be the best thing humans came up with so far, if you want nice stuff that requires coordination. You also have to "beg" for a connection & ip address. You also have to "beg" for a DNS name. Please propose something better (that doesn't come with its own significant drawbacks).
That is a false statement. Using 'what could happen' logic, Windows should label Chrome/Firefox/IE as insecure/malware since someone could theoretically do bad things with those tools.
>Please propose something better (that doesn't come with its own significant drawbacks).
Why don't you start first? Since this HTTPS so-called 'solution' has its own significant drawbacks.
What evidence does Chrome have that my site is insecure or poses a threat to users?
'What could happen' logic would mean disabling all browsers since you could get pwned by using any of them. That is not a rational way to approach anything.
The fact that it is using HTTP, and therefore can be trivially MITMed by anyone controlling any point traversed between you and the client. Communication between the browser and your server is insecure.
Whether that is an important fact to users is a decision users will need to make, but it is a fact.
> 'What could happen' logic would mean disabling all browsers since you could get pwned by using any of them.
Clearly, to the extent that is accurate, that's not the logic at issue since nothing is being disabled here. So, please, stop with the irrelevant strawmen.
Can you please link to any evidence showing the millions of HTTP sites that were MITMed? I mean after all its so trivial as you claim. OTOH, why would anyone care to do that when they've found it much easier to trivially inject scripts and other potentially harmful stuff via compromised ads, third party hosted JS scripts, compromised CDNs, etc, etc. The current proposal fails to address any of those real, actual, tangible 'bad' things that are actually occuring with alarming frequency.
>Communication between the browser and your server is insecure.
That applies to every single piece of data transfered that is not under the control of the domain being visited.
>Clearly, to the extent that is accurate, that's not the logic at issue since nothing is being disabled here. So, please, stop with the irrelevant strawmen.
Simply asserting it doesn't make it so. I reject your interpretation. The most dominant browser vendor showing scrary yellow triangles with exclamation marks, instead of showing your webpage is exactly like disabling it.
No, it'd not, and we know it's not because the much more forceful click-through warnings they used for HTTPS certificate errors (because scary red icons in the address bar failed) still had a high enough click-through rate when the “proceed” link wasn't hidden behind a multi-click process hidden behind an “advanced” button that, well, they invented the multistep, hidden process they use now for certificate errors.
And, anyway, the UI they've shown is simple light grey “Not Secure” text, not a “scary yellow triangle”. It's not anything like blocking, and it's not a blocking attempt that failed because—frommthr experience with certificate errors—they know how much it takes to really stop casual web users from proceeding in the face of a security warning.
Pretty much every single one, when accessed from a hotel or public wi-fi network that injects ads into pages?
What you are describing is how things are working for now.
First, there's now guarantee Let's Encrypt will be here tomorrow. You're pinning the future of the Internet onto the shoulders of maybe a dozen people who run it.
Second, CA's are - by definition - centralized. There's no guarantee that, in principle, you'll always be able to get a certificate for them.
The Internet was designed to be distributed and hard to break. HTTPS-only Internet is going backwards on this.
I'm all for security and privacy, but any solution that requires a centralized third-party for the whole system to function is, in my opinion, broken by design.
There's that, and there's making the system needlessly complicated for many tasks. There are very, very many websites and users (I'd say - the absolute majority) who are OK with the Dangers Of HTTP (that is, some intermediate party being aware that you read a certain webpage). Worrying about that in the age where every step is tracked, every face detected, and every page is full of trackers seems, to me, facetious.
This is an absurd thing to say when Let's Encrypt exists.