Re: HTTP is just fine

* If you want to run HTTPS on your website, go for it.
* If you want to encourage HTTPS by making it easier to set up, go for it.
* If you want to *force* *me* to use HTTPS, then you're overstepping 
your power.

My problems with HTTPS:
* It uses TLS, which is (deliberately) misdesigned from the start and 
puts trust in the wrong place, making it inherently insecure. It was 
*explicitly* designed to only protect credit cards during your Amazon 
order purchase. (If you have doubts, check your CA's contracts.) That 
means you can't even use TLS to protect passwords or token that would - 
if stolen - make damages superior to 1 million US$, much less things 
without price tag, like privacy, human rights or human life. My problem 
is that TLS is offered as solution against government surveillance.
* It's very hard to set up. It's made even more difficult now that I 
can't even get an IPv4 address for my each of my servers (not just the 
web domain) anymore.
* The primary value of the Internet is that the barrier of entry is very 
low. Nobody was there to forbid me my idea. That's what allowed this 
strong and fast innovation.
* The DNS is already a big problem, finding a memorable domain and name 
for my company has become one of the primary obstacles. And you want to 
add another *mandatory* central point, the CAs, which have again and 
again violated the security guarantees, e.g. by issuing intermediate "*" 
certificates to private companies, allowing them to intercept all TLS 
traffic.

HTTP is *the* most common communication protocol. It's used for so many 
things that it's hard to list them all, including internal services 
within the local network. And you want to kill it. Doesn't look like a 
wise move to me.

Instead of *forcing* HTTPS and TLS on everybody, why don't you ask 
people why they haven't used it yet, and then solve their problems?

Encouraging HTTPS: Progress.
Mandating it: Destructive.

Ben