On Mon, 1 Jun 2015, Niels Dettenbach wrote:
- And: there ARE poeples and services which doen't allow encrypted access for legal or organisational reasons - it would not be nice to block interested poeples from such user "societies" which are not usually free to decide for an alternative byself.
And that resoning is exactly how we _got_ into this mess in the first place. We had to cater to governments banning encryption for its users, and we now see what that got them. I can no longer prevent goverments interpreting my online self based on 20 years of data, but I sure hope we can prevent that for future generations. We should have said no to governments in the previous crypto war - and we definitely have to say no now. Enterprise users are no problem, they have enterprise-issued local policy and can override all the TLS they want with MITM certs and proxies and mandated software on the enterprise hardware.
And for me personal: I use a 7 year old cell phone to read http stuff in my spare time and do not understand why i should buy a new one for the very same application.
A cell phone that cannot do SSL/TLS (or worse, 7 year old SSL only) is a danger to its owner and possibly to the internet at large if it is owned by botnets already. Paul