7

Although no browser implements the full HTTP/2 spec right now limiting themselves to just the TLS part there are stories on the internet that this incomplete implementation of the spec is a way of resisting against the 'evil' lobbying of mobile service providers which want to inject ads and shape traffic. Now, I of course understand that analyzing, shaping and even altering traffic is possible on unsecured connections, but is it actually true that the lack of consensus on required TLS was caused by the lobbying of internet service providers? And secondary, is there reason to believe that if that's the case, that this was for the claimed reasons primarily.

  • I was a bit in doubt whether to post this on skeptics.SE or here, but I figured that there are people here who followed the process of the HTTP/2 spec being written, so I would ask here. If it's offtopic here then please just close/migrate to skeptics.SE (and I will fix the post with a clear quoted notable claim). – David Mulder Jan 29 '16 at 17:39
  • 1
    I haven't been following HTTP/2 design, but my first thought is "browsers already do TLS, it was probably a really easy part to build based on their existing codebase". Next, "there were bound to be concerns about low power/mobile clients being unable to handle HTTPS overhead, or ISPs being unable to add caching proxies on high latency connections". Then traffic shaping isn't just evil and anti-competitive, it can be part of a reasonable tiered business model. In other words - what evidence makes you think there was lobbying of ISPs motivated by advertising and evil traffic shaping? – TessellatingHeckler Jan 29 '16 at 18:15
  • @TessellatingHeckler That this is an oft repeated story on the internet. Is that evidence? Nope, that's why I am asking whether it's true here ;-) Personally I think it's weird that browsers require HTTP/2 for 'cool new features'. – David Mulder Jan 29 '16 at 18:28
  • They often not require HTTP/2 but HTTPS. For example brotli compression is only enabled with HTTPS for current Firefox and the next Chrome. The main reason is fear of incompatibility with existing systems in the believe that HTTPS is safer against inspection by broken devices. – Steffen Ullrich Jan 29 '16 at 18:42
  • 3
    I'm voting to close this question as off-topic because, based on your comments to Steffen's answer, you seem to be looking for an opinion from someone who was on the standard committee or who closely tracked the committee's work. Such a question seems too subjective for the format of this site. – Neil Smithline Jan 29 '16 at 20:10
11

There is no technical reason to limit HTTP/2 to TLS. Communication without TLS has its technical use, no matter if this is unencrypted traffic or if the traffic is encrypted by other means (VPN etc).

Restricting HTTP/2 to TLS in the standard would bind the use of the HTTP/2 protocol to the use of TLS for political(*) reasons only. Such bindings for non-technical reasons are usually avoided: If you look for example at the RFC for HTTP/1.1 they explicitly keep the transport layer open, i.e. acknowledge that HTTP/1.1 is usually used on top of TCP/IP but might be used on top of other protocols (RFC2616, section 1.4).

Thus while one might think that there was some evil lobbying I think that simply the majority found that standards should be a place for technical details but not for political(*) statements.

An interesting mailing thread in this context is Mandatory encryption is theater on the IETF HTTP WG mailing list in 2013 which highlights the diversity of opinions among the technical users. And is also visible from this thread that this is not a lobbying from some ISP or similar but that there are technical reasons to not bind HTTP/2 too much to TLS, because TLS is known to be not the optimal solution for the diversity of authentication, encryption and privacy problems: in some cases you want to have better protection than TLS can offer and in other cases you don't need the protection but the overhead of TLS is bothering you.

(*) To make more clear what I consider political: It's less geo-politics or company-politics but mostly personal opinions influenced by these larger politics. This leads to arguments based on the personal view of how the world should work and not based on technical reasons. Sometimes this political arguments are even blind to technical arguments because they don't fit into the personal view of the world. This includes the argumentation that all use cases require privacy (which TLS does not offer fully anyway), that small systems without large resources should just grow up or not use HTTP, that caching is an unimportant thing which does not need to be considered (i.e. we have lots of bandwidth and don't care if others don't) etc.

  • But is this the reason why they didn't do it? As in, did you follow the development of the spec? Because originally it was intended to be included and it was removed at a later date. – David Mulder Jan 29 '16 at 18:27
  • I did not follow the discussions in detail but only loosely. But you can read a more detailed view at daniel.haxx.se/blog/2015/03/06/tls-in-http2. In effect - there were enough technical reasons not to make TLS mandatory and the only reasons to make it mandatory where political and not technical. – Steffen Ullrich Jan 29 '16 at 18:37
  • But see, when I open that link it says "Who were against mandatory TLS? Yeah, lots of people ask me this, but I will refrain from naming specific people or companies here since I have no plans on getting into debates with them about details and subtleties in the way I portrait their arguments. You can find them yourself if you just want to and you can most certainly make educated guesses without even doing so." so -1 because that's exactly what I am trying to find out. – David Mulder Jan 29 '16 at 18:40
  • As in, nothing in that link or your post answers the question whatsoever. If anything the link you provide leaves the option entirely open that it was primarily internet service providers who lobbied against making it mandatory. Especially as it wasn't the browsers as indicated by the fact that they did make it mandatory in the end. – David Mulder Jan 29 '16 at 18:42
  • @DavidMulder: I've added a link to a discussion at the IETF mailing list from 2013 where this problem is discussed. In my opinion this shows that there are enough technical reasons to not make HTTP/2 depend on TLS and that not the lobbying of some ISP was the ultimate problem. – Steffen Ullrich Jan 29 '16 at 20:48
4

Mandatory encryption presents at least one thing that non-encrypted communication doesn't. Truly encrypted communication, end-to-end (at least http over SSL) is impossible to cache and requires more bandwidth. Requiring SSL/TLS would limit the case for non-sensitive information from being cached by some intermediate proxy server.

Encryption also has a cost. It adds some overhead, and adds some processing power. But then so do many features of any protocol. So it's a fair question to ask why encryption is special, and is optional.

There's some practical reasons to not require TLS as well. Unless you want to train users to skip through scary self-signed, or expired certificates, TLS requires you to obtain a signed certificate for each endpoint, and maintain it since they expire. There's millions of devices in homes and businesses that communicate over http. Baby monitors, washing machines, routers, phones, etc all commonly have http interfaces. Requiring TLS would mean these devices couldn't adopt http 2, and would have to stay on http 1.1.

There's other concerns too, but I think it highly involves what's valued. Stephen calls this "political", but this seems like an oversimplification over a standards argument. Political can mean a lot of things. Sometimes it means conflicting interests. Sometimes it means "geo-political", and sometimes it's about political ideology. And sometimes it means... I don't even know what. Throwing all that into one bucket seems a bit reductive in my view.

  • "Encryption also has a cost. It adds some overhead, and adds some processing power." My first thought. Imagine an Arduino or other microcontroller trying to do TLS. – The6P4C Jan 30 '16 at 13:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.