Re: Proposal: Marking HTTP As Non-Secure

On 8 February 2016 at 10:58, Craig Francis <[email protected]> wrote:

> I certainty take your point that HTTPS is currently more difficult than it needs to be,

The main practical problem is that HTTPS cannot be enabled gradually
without worsening user experience. Consider a website that uses images
from other sites that do not have HTTPS. Then the encryption cannot be
activated without worsening user experience in form of broken lock
icons in the address bar. LetsEncrypt does not help to address this.
Why should one spend even trivial efforts if that worsen the
experience?

I really wish there would way to serve encrypted pages over http://
Then as a site operator I can gradually start, for example, with
self-encrypted certificate for the main page and user would not spot a
difference. Then I add encryption for all page resources, then add
LetsEncrypt certificate. Again, at each stage the user experience
stays the same even with presence of encrypted media files from other
sites. Finally, when I know that all resources can be accessed over
https://, I redirect to htpps:// the main site.