Subject: Re: [quicwg/base-drafts] HTTP/QUIC without Alt-Svc? (#253)

From: fbifido <[email-masked]>
Date: Wed, 06 Nov 2019 16:38:57 -0800

Since QUIC is secure?
1) Will we need WebSite Certificates?
2) Will we be able to use HTTP:// and still be secure on QUIC?
3) Will we still use HTTPS:// or will there be a QUIC://?
4) will QUIC put and end to Man-in-the-Middle attacks?
5) Can we secure emails and other communications over QUIC?
Thanks.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/253#issuecomment-550566379

---

From: Mike Bishop <[email-masked]>
Date: Thu, 07 Nov 2019 07:23:00 -0800

Not exactly the place for this question.

QUIC uses TLS, so you'll need a certificate to terminate a QUIC connection.  If a browser implements the mechanism to upgrade http:// URLs to TLS [RFC8164], it could do the same to upgrade to QUIC; I'm not aware that any do.  QUIC will not be a separate scheme.  QUIC will detect all the same MitM attacks that TLS does; if you trust a malicious root cert, nothing will help you.  QUIC is a transport, so it could be used for other application-level protocols in the future if those protocol mappings are defined.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/253#issuecomment-551125503

---

From: Lucas Pardue <[email-masked]>
Date: Fri, 08 Nov 2019 06:00:09 -0800

3 Jun
> Discussed in London; still waiting for text from httpwg/http-core#194.

on 194
 > mnot closed this on 20 Aug 

so are we waiting for something else now?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/253#issuecomment-551838131

---

From: Mike Bishop <[email-masked]>
Date: Fri, 08 Nov 2019 07:08:21 -0800

https://github.com/httpwg/http-core/issues/194 was split into separate issues; the piece we need is now https://github.com/httpwg/http-core/issues/237.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/253#issuecomment-551863955