On Mon, 1 Jun 2015, Niels Dettenbach wrote:
- And: there ARE poeples and services which doen't allow encrypted access for
legal or organisational reasons - it would not be nice to block interested
poeples from such user "societies" which are not usually free to decide for an
alternative byself.
And that resoning is exactly how we _got_ into this mess in the first
place. We had to cater to governments banning encryption for its users,
and we now see what that got them. I can no longer prevent goverments
interpreting my online self based on 20 years of data, but I sure hope
we can prevent that for future generations. We should have said no to
governments in the previous crypto war - and we definitely have to say
no now.
Enterprise users are no problem, they have enterprise-issued local policy
and can override all the TLS they want with MITM certs and proxies and
mandated software on the enterprise hardware.
And for me personal: I use a 7 year old cell phone to read http stuff in my
spare time and do not understand why i should buy a new one for the very same
application.
A cell phone that cannot do SSL/TLS (or worse, 7 year old SSL only) is
a danger to its owner and possibly to the internet at large if it is
owned by botnets already.
Paul