Intent to deprecate: Insecure HTTP

Re:Intent to deprecate: Insecure HTTP by bifurcation on Monday April 13, 2015 @02:22PM (#9369384)

The use of HTTPS doesn't destroy cacheability, it just requires that one of the legitimate endpoints authorize the cache to be there.

[ Parent | on HN ]

Re:Intent to deprecate: Insecure HTTP by voidlogic on Monday April 13, 2015 @02:26PM (#9369406)

Right, it forces the cache to come from the content provider rather than being provided downstream by the client's organization.

[ Parent | on HN ]

Re:Intent to deprecate: Insecure HTTP by profmonocle on Monday April 13, 2015 @02:48PM (#9369560)

But for many users, their downstream organization is their ISP. From my point of view, any caching by them is malicious. I didn't send my request to the IP of their caching server, I sent it to the IP of the site I'm trying to reach. Redirecting my request to their cache is a MITM attack.

If my employer wants to use caching, they can install a cert for their proxy on my machine (or require me to do so), so it's not a problem - although it is more technically complex.

[ Parent | on HN ]

Re:Intent to deprecate: Insecure HTTP by Dylan16807 on Monday April 13, 2015 @02:37PM (#9369472)

If it's inside the organization then they can put in a local cert and run a cache.

It only prevents caches that are in the middle and trusted by neither end. I'm okay with that in almost all cases.

[ Parent | on HN ]

Re:Intent to deprecate: Insecure HTTP by voidlogic on Monday April 13, 2015 @02:47PM (#9369558)

What about dorms, hospitals (patient wifi), libraries, hotels, cafes and small ISPs? They do not have access to their clients certs-

[ Parent | on HN ]