Finalizing the HTTPS-Only Standard as formal policy #108
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Calling forward secrecy 'perfect' is misleading and unnecessary. 'Key erasure' is more accurate, but 'forward secrecy' has stuck.
* Incorporate integrity mention into Goal paragraph more tersely.
* Remove privacy mention from SNI paragraph, since the concern is
described earlier in the memo ("What HTTPS Doesn't Do"), and is
now incorporated into the SNI document this paragraph links to.
* Remove description of HTTPS config issues for third party
content from Mixed Content paragraph. HTTPS resources from third
parties is no longer "mixed content", and is better handled in
the guidance. Added a link to the guidance page for Mixed
Content.
* Edit Security Considerations paragraph on mixed content page to
describe the issue as "third party content" (since the content
is no longer mixed) and to emphasize that these considerations
are not *introduced* by HTTPS, but are rather still present
under HTTPS (though the situation is much improved).
This indicates explicitly that priority websites should begin their migration immediately. Timeframe is adjusted from "two years" to December 31, 2016.
konklone
added a commit
that referenced
this pull request
Jun 8, 2015
Finalizing the HTTPS-Only Standard as formal policy
Closed
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The proposed HTTPS-Only Standard has now been finalized as the White House Office of Management and Budget memorandum M-15-13, "Policy to Require Secure Connections across Federal Websites and Web Services".
This pull request contains some changes between the original proposal, and the finalized version, detailed below.
Thanks to everyone who participated in the public comment period! The public comment period elicited a number of highly detailed and helpful submissions, and the resulting policy is better for this feedback.
For more details, the White House, 18F, and the CIO Council each have some accompanying blog posts about the release of the policy:
Below are some details on the changes we've made since the original proposal. I've mapped some to commits, but some are lumped in to others.
Thank you again to everyone who participated!
Fixes #78, fixes #79, fixes #80, fixes #81, fixes #83, fixes #84, fixes #86, fixes #87, fixes #88, fixes #89, fixes #92, fixes #93, fixes #94, fixes #95, fixes #96, fixes #97, fixes #98, fixes #99, fixes #100, fixes #101, fixes #103, fixes #104, fixes #105, fixes #106, and fixes #107.