Re:Intent to deprecate: Insecure HTTP
by bifurcation on Monday April 13, 2015 @02:22PM
(#9369384)
The use of HTTPS doesn't destroy cacheability, it just requires that one of the legitimate endpoints authorize the cache to be there.
Right, it forces the cache to come from the content provider rather than being provided downstream by the client's organization.
Re:Intent to deprecate: Insecure HTTP
by profmonocle on Monday April 13, 2015 @02:48PM
(#9369560)
But for many users, their downstream organization is their ISP. From my point of view, any caching by them is malicious. I didn't send my request to the IP of their caching server, I sent it to the IP of the site I'm trying to reach. Redirecting my request to their cache is a MITM attack.
If my employer wants to use caching, they can install a cert for their proxy on my machine (or require me to do so), so it's not a problem - although it is more technically complex.
Re:Intent to deprecate: Insecure HTTP
by Dylan16807 on Monday April 13, 2015 @02:37PM
(#9369472)
If it's inside the organization then they can put in a local cert and run a cache.
It only prevents caches that are in the middle and trusted by neither end. I'm okay with that in almost all cases.
What about dorms, hospitals (patient wifi), libraries, hotels, cafes and small ISPs? They do not have access to their clients certs-
Re:Intent to deprecate: Insecure HTTP
by Dylan16807 on Monday April 13, 2015 @02:15PM
(#9369332)
How much of the internet is actually cached? Especially when most of the traffic is video feeds that always get resent.
When I worked for an IT consulting firm I saw medium sized institutions (colleges, hospitals, hotels) save huge amounts of bandwidth by implementing transparent HTTP caches.
I totally am for securing POSTs, HTML, etc with SSL, but images and CSS, etc really make little sense.
How is this not going to destroy the cachability of the internet?
Being able to operate transparent caches is important for institutions (Edit: some which may not have access to their users local cert stores).
There is many things like blogs, news articles, photo galleries that gain zero value by being encrypted. Encrypting these things is going to require more hardware, more energy usage and more bandwidth and thus again more energy usage.