http support encryption without
https, akin to
This may sound like a stupid question, but just think about it.
Banks require strong encryption, and cannot do business without it.
However, regular websites may not necessarily do so, but would benefit from casual encryption nonetheless, preventing many kinds of attacks, just as is the case with
As such, for a regular web-site, if the browser is having any issues with ssl (be that protocol incompatibility, an underpowered mobile device, or an explicit preference of the user), it should just safely proceed without encryption without too much extra hassle.
Is there any extension of the
HTTP protocol that would allow for encryption without explicit use of
https? E.g. something akin
Accept-Encoding: gzip and
Content-Encoding: gzip? Or
smtp? If not, why not? Even WPA2 from WiFi comes to mind, which does do encryption, but doesn't bother with certificates or certificate authorities.
Basically, I'm thinking about something like the HTTPS-Everywhere extension, but which works automatically without the viral propaganda of the
https:// address scheme -- without forcing people who don't want to be a part of it to be a part of it, like the
https:// address scheme does, without dividing the address scheme, and without requiring the content provider to commit to always supporting
https:// from thereon.