Re: Auto-selection of secure protocol

On Fri, 10 Oct 2008 09:31:26 +0200, in message <[email protected]>,
Guillaume Michaud wrote:

> With the increasing number of online services (Gmail, Meebo and so on),
> privacy and security on the web is of an increasing importance, which
> reflects on Mozilla's attitude towards SSL certificates and so on.
> Some of such online services (such as Gmail and Meebo, again) can be
> accessed securely with an encrypted connection. However, this is not always
> the case, and when it is possible, the service providers seldomly "force"
> their users to use encryption.
> In short, this means that users who are not computer-savvy never use the
> encrypted versions.
> 
> This is mainly because when a user types "myurl" in the url bar of his
> browser, he is automatically redirected to http://myurl by the browser, and
> never to https://myurl, excepts if the service provider has enabled the
> redirection.
> 
> It could be interesting to offer the user a functionnality which, by
> default, allows the user to use the encrypted version of a web page, that is
> to say to redirect him to https://myurl instead of http://myurl when he
> types "myurl" in the adresse bar.


The impact on Firefox users is that it will often take longer to open 
websites when the user types "myurl" in the url bar.


Often, Firefox will not know in advance whether https://myurl exists.
Firefox would first have to try https://myurl -- and if that did not 
exist, then try http://myurl .  Problem is, trying https://myurl just 
to have it fail can add more time  than the Firefox user wants to wait.  

I just tested this here, and it took 50 seconds just to try the https 
site when only the http site existed.  That is the kind of time this
will add to opening "myurl".


> The problem of https://myurl and http://myurl not being the same page could
> be addressed with a white-list system, or exceptions.

This proposal needs someone (or someones) to maintain a world-wide white-list 
on the ever-changing web.

The objective is clearly to cater for the "non computer-savvy" who won't
be maintaining their own white-lists.  The "non computer-savvy" also won't
be manually retrieving updates to the white-list, so Firefox will have to
do this automatically.


> The objective is clearly to enable non computer-savvy to use encrypted
> versions by default, wether they know there is an encrypted version or not.
> 
> What do you think about it ?


It is a nice concept, but it has a few hurdles.  Can you suggest how these 
hurdles may be overcome?


-- 
Cheers,
Ralph