Maybe I'm missing something, but what are the advantages of this over simply enabling HTTPS for everything? Performance, maybe, but Google has been often-quoted these past couple days calling that a very small issue.
It sounds like you're still assuming HTTPS to start the connection, then transitioning to a different encryption / authentication scheme after that. It would still require the time and effort involved in making the switchover (both HTTPS and the new bits) on a large scale, and any new parts of the plan would need to be made to work with old browsers and operating systems on the client. And since most of the data would be unencrypted, a lot of potentially-sensitive data could still be sniffed.
So I think you're overcomplicating things. We already have a good system in place to handle this stuff, people are just too lazy / ignorant / indifferent / resisistant-to-change to make it standard. See also IPv6.
Comments
Maybe I'm missing something, but what are the advantages of this over simply enabling HTTPS for everything? Performance, maybe, but Google has been often-quoted these past couple days calling that a very small issue.
It sounds like you're still assuming HTTPS to start the connection, then transitioning to a different encryption / authentication scheme after that. It would still require the time and effort involved in making the switchover (both HTTPS and the new bits) on a large scale, and any new parts of the plan would need to be made to work with old browsers and operating systems on the client. And since most of the data would be unencrypted, a lot of potentially-sensitive data could still be sniffed.
So I think you're overcomplicating things. We already have a good system in place to handle this stuff, people are just too lazy / ignorant / indifferent / resisistant-to-change to make it standard. See also IPv6.