News for hackers. Stuff that matters.

A comment on Marking HTTP as Non-Secure. Parent comment

Re:Marking HTTP as Non-Secure by cnst on Saturday December 13, 2014 @02:15PM (#8746022)
1) Why not implement passive encryption? Like StartTLS in SMTP? No need for HTTPS; could be part of HTTP/2 over port 80.

2) Pinning?

3) No, let's not do that. I want to be able to access my sites from my 2-year old devices that don't support SNI, like Android 2.3.

[ Parent | on HN ]
Re:Marking HTTP as Non-Secure by expr- on Saturday December 13, 2014 @03:07PM (#8746192)
Do you really care about accessing sites with 10-year-old mobile devices using only stock apps (emphasis: long term)?
[ Parent | on HN ]