The worst idea ever: Let's break SSL for mobile users

This is definitely the scariest and stupidest idea I have heard in a very long time: some people on the W3C Mobile Web Best Practices Working Group think that is acceptable to break SSL—the security backbone of the Internet—in order to help transcoding proxies reformat content for mobile users:

• The “WAP Gap” All Over Again - W3C, HTTPS and Transcoding

This just demonstrates one of the reasons we suck at security: small groups of people who do not really know what they are doing wield significant power and affect millions. It's like year 2000 all over again. We are lucky when in some cases (such as in this one) there are informed people willing to stand for what's right.

Comments

[Jeff Sonstein]

note that the email quoted in the article to which you refer opens with the statement: "I haven’t read the specs, but [...]".

note also that there is a spirited discussion going on at W3C which, in part, includes a strong *defense* of the idea that transcoding proxies should leave HTTPS URIs alone. the assertions about what is happening are just plain inaccurate.

please do read the doc linked to at http://chw.rit.edu/blog before you come to conclusions, and please leave comments at CHW so your input can be attended to... that was the idea of the original discussion: making sure W3C hears from lots of informed people about this and other issues related to the Mobile Web.

jeffs

[Ivan Ristić]

Hi Jeff,

I was commenting on the desire (of some members of the group) and the discussion, which I've read in full before commenting. I wrote that "some people [...] think that it is acceptable to break SSL", and that seems pretty accurate to me. To me, just the fact that such a discussion is taking place is bad enough. Hence my comment.

Thank you for the link to the Mobile Web Application Best Practices draft. I will be happy to read and comment on it. If you want to seek input from security-minded people, the best thing to do is post to the Web Security Mailing List: http://www.webappsec.org/lists/websecurity/