Although no browser implements the full HTTP/2 spec right now limiting themselves to just the TLS part there are stories on the internet that this incomplete implementation of the spec is a way of resisting against the 'evil' lobbying of mobile service providers which want to inject ads and shape traffic. Now, I of course understand that analyzing, shaping and even altering traffic is possible on unsecured connections, but is it actually true that the lack of consensus on required TLS was caused by the lobbying of internet service providers? And secondary, is there reason to believe that if that's the case, that this was for the claimed reasons primarily.
Asked
Active
Viewed 992 times
9
-
I was a bit in doubt whether to post this on skeptics.SE or here, but I figured that there are people here who followed the process of the HTTP/2 spec being written, so I would ask here. If it's offtopic here then please just close/migrate to skeptics.SE (and I will fix the post with a clear quoted notable claim). – David Mulder Jan 29 '16 at 17:39
-
1I haven't been following HTTP/2 design, but my first thought is *"browsers already do TLS, it was probably a really easy part to build based on their existing codebase"*. Next, *"there were bound to be concerns about low power/mobile clients being unable to handle HTTPS overhead, or ISPs being unable to add caching proxies on high latency connections"*. Then *traffic shaping isn't just evil and anti-competitive, it can be part of a reasonable tiered business model*. In other words - what evidence makes you think there was lobbying of ISPs _motivated by advertising and evil traffic shaping_? – TessellatingHeckler Jan 29 '16 at 18:15
-
@TessellatingHeckler That this is an oft repeated story on the internet. Is that evidence? Nope, that's why I am asking whether it's true here ;-) Personally I think it's weird that browsers require HTTP/2 for 'cool new features'. – David Mulder Jan 29 '16 at 18:28
-
They often not require HTTP/2 but HTTPS. For example brotli compression is only enabled with HTTPS for current Firefox and the next Chrome. The main reason is fear of incompatibility with existing systems in the believe that HTTPS is safer against inspection by broken devices. – Steffen Ullrich Jan 29 '16 at 18:42
-
3I'm voting to close this question as off-topic because, based on your comments to Steffen's answer, you seem to be looking for an opinion from someone who was on the standard committee or who closely tracked the committee's work. Such a question seems too subjective for the format of this site. – Neil Smithline Jan 29 '16 at 20:10
-
@NeilSmithline The answers present personal opinions and I am looking for hard facts, I find it somewhat insulting that looking for referenced facts about security has someone ended as 'seemingly looking for opinion'. I mean, this question might well be off topic, but if it's off topic it's because of the theme of the question (decision making processes behind security aspects of specs), not due to subjectiveness. I mean, it can be argued that one doesn't know for sure what the 'real' reasons were a group lobbied against something, but (cont.) – David Mulder Jan 29 '16 at 22:47
-
at least whether ISP where the main lobby is a totally factual question. – David Mulder Jan 29 '16 at 22:48
-
My apologies @DavidMulder. I used the word "subjective" because it is one of the common reasons for closing questions on this site. Perhaps I was careless in my choice. I generally think the question is an interesting one, just not one that is a good fit for this site. I think that's demonstrated by Steffen's answer being upvoted while you think that it doesn't respond to your question. Again, sorry for my word choice. – Neil Smithline Jan 30 '16 at 02:20
-
@NeilSmithline As I pointed out in my first comment I am totally fine with it if this question is off topic, but just because it's somewhat different doesn't make a question off topic. I mean, it clearly has *something* to do with (expert) security and as I also said before, I can't seem to find reasons for it to be off topic. Maybe I missed something on meta though... but would be good to link that here then. Either way, Steffen answer now answers the question, but I am not sure whether the existence of an upvoted and interesting but back (cont.) – David Mulder Jan 30 '16 at 09:27
-
then subjective answer is grounds for the question itself to be offtopic. :/ – David Mulder Jan 30 '16 at 09:27
2 Answers
12
There is no technical reason to limit HTTP/2 to TLS. Communication without TLS has its technical use, no matter if this is unencrypted traffic or if the traffic is encrypted by other means (VPN etc).
Restricting HTTP/2 to TLS in the standard would bind the use of the HTTP/2 protocol to the use of TLS for political(*) reasons only. Such bindings for non-technical reasons are usually avoided: If you look for example at the RFC for HTTP/1.1 they explicitly keep the transport layer open, i.e. acknowledge that HTTP/1.1 is usually used on top of TCP/IP but might be used on top of other protocols (RFC2616, section 1.4).
Thus while one might think that there was some evil lobbying I think that simply the majority found that standards should be a place for technical details but not for political(*) statements.
An interesting mailing thread in this context is Mandatory encryption is theater on the IETF HTTP WG mailing list in 2013 which highlights the diversity of opinions among the technical users. And is also visible from this thread that this is not a lobbying from some ISP or similar but that there are technical reasons to not bind HTTP/2 too much to TLS, because TLS is known to be not the optimal solution for the diversity of authentication, encryption and privacy problems: in some cases you want to have better protection than TLS can offer and in other cases you don't need the protection but the overhead of TLS is bothering you.
(*) To make more clear what I consider political: It's less geo-politics or company-politics but mostly personal opinions influenced by these larger politics. This leads to arguments based on the personal view of how the world should work and not based on technical reasons. Sometimes this political arguments are even blind to technical arguments because they don't fit into the personal view of the world. This includes the argumentation that all use cases require privacy (which TLS does not offer fully anyway), that small systems without large resources should just grow up or not use HTTP, that caching is an unimportant thing which does not need to be considered (i.e. we have lots of bandwidth and don't care if others don't) etc.
Steffen Ullrich
- 184,332
- 29
- 363
- 424
-
But is this the reason why they didn't do it? As in, did you follow the development of the spec? Because originally it *was* intended to be included and it was removed at a later date. – David Mulder Jan 29 '16 at 18:27
-
I did not follow the discussions in detail but only loosely. But you can read a more detailed view at http://daniel.haxx.se/blog/2015/03/06/tls-in-http2/. In effect - there were enough technical reasons not to make TLS mandatory and the only reasons to make it mandatory where political and not technical. – Steffen Ullrich Jan 29 '16 at 18:37
-
But see, when I open that link it says "Who were against mandatory TLS? Yeah, lots of people ask me this, but I will refrain from naming specific people or companies here since I have no plans on getting into debates with them about details and subtleties in the way I portrait their arguments. You can find them yourself if you just want to and you can most certainly make educated guesses without even doing so." so -1 because that's **exactly** what I am trying to find out. – David Mulder Jan 29 '16 at 18:40
-
As in, nothing in that link or your post answers the question whatsoever. If anything the link you provide leaves the option entirely open that it was primarily internet service providers who lobbied against making it mandatory. Especially as it wasn't the browsers as indicated by the fact that they *did* make it mandatory in the end. – David Mulder Jan 29 '16 at 18:42
-
@DavidMulder: I've added a link to a discussion at the IETF mailing list from 2013 where this problem is discussed. In my opinion this shows that there are enough technical reasons to not make HTTP/2 depend on TLS and that not the lobbying of some ISP was the ultimate problem. – Steffen Ullrich Jan 29 '16 at 20:48
-
I'm going to flat out disagree that mandatory encryption is solely political, and not technical. Security from interception is most certainly a use case and an important one. Now, encryption creates some problems in that you can't cache https without MiTM, but that's really purely about efficiency and use case, and not what most would call political. You can make anything into a political argument. My choice of lunch could be turned into politics for instance, but that doesn't make my decision inherently political. – Steve Sether Jan 29 '16 at 21:39
-
@SteveSether: There are use cases for HTTP/2 without encryption, there are use cases for use with TLS, there are use cases with other kinds of encryption like IPSec. There is neither a technical reason to enforce use of TLS for encryption nor to restrict the encryption to TLS. Encryption and Application are two different layers which can be combined as they are needed. But I don't think this is the place to redo all the discussions again. Just have a look at the heated discussions at the IETF mailing list. – Steffen Ullrich Jan 30 '16 at 05:17
4
Mandatory encryption presents at least one thing that non-encrypted communication doesn't. Truly encrypted communication, end-to-end (at least http over SSL) is impossible to cache and requires more bandwidth. Requiring SSL/TLS would limit the case for non-sensitive information from being cached by some intermediate proxy server.
Encryption also has a cost. It adds some overhead, and adds some processing power. But then so do many features of any protocol. So it's a fair question to ask why encryption is special, and is optional.
There's some practical reasons to not require TLS as well. Unless you want to train users to skip through scary self-signed, or expired certificates, TLS requires you to obtain a signed certificate for each endpoint, and maintain it since they expire. There's millions of devices in homes and businesses that communicate over http. Baby monitors, washing machines, routers, phones, etc all commonly have http interfaces. Requiring TLS would mean these devices couldn't adopt http 2, and would have to stay on http 1.1.
There's other concerns too, but I think it highly involves what's valued. Stephen calls this "political", but this seems like an oversimplification over a standards argument. Political can mean a lot of things. Sometimes it means conflicting interests. Sometimes it means "geo-political", and sometimes it's about political ideology. And sometimes it means... I don't even know what. Throwing all that into one bucket seems a bit reductive in my view.
Steve Sether
- 21,480
- 8
- 50
- 76
-
"Encryption also has a cost. It adds some overhead, and adds some processing power." My first thought. Imagine an Arduino or other microcontroller trying to do TLS. – The6P4C Jan 30 '16 at 13:00