Does http
support encryption without https
, akin to STARTTLS
in smtp
?
This may sound like a stupid question, but just think about it.
Banks require strong encryption, and cannot do business without it.
However, regular websites may not necessarily do so, but would benefit from casual encryption nonetheless, preventing many kinds of attacks, just as is the case with STARTTLS
in smtp
.
As such, for a regular web-site, if the browser is having any issues with ssl (be that protocol incompatibility, an underpowered mobile device, or an explicit preference of the user), it should just safely proceed without encryption without too much extra hassle.
Is there any extension of the HTTP
protocol that would allow for encryption without explicit use of https
? E.g. something akin Accept-Encoding: gzip
and Content-Encoding: gzip
? Or STARTTLS
in smtp
? If not, why not? Even WPA2 from WiFi comes to mind, which does do encryption, but doesn't bother with certificates or certificate authorities.
Basically, I'm thinking about something like the HTTPS-Everywhere extension, but which works automatically without the viral propaganda of the https://
address scheme -- without forcing people who don't want to be a part of it to be a part of it, like the https://
address scheme does, without dividing the address scheme, and without requiring the content provider to commit to always supporting https://
from thereon.
Upgrade
header.