From: Alan Olsen <alano@teleport.com>
Date: Sat, 16 Mar 1996 08:06:55 +0800
To: cypherpunks@toad.com
Subject: Re: Interesting Egghead freebee
Message-ID: <2.2.32.19960315212951.008b4d54@mail.teleport.com>
MIME-Version: 1.0
Content-Type: text/plain


At 10:37 AM 3/15/96 -6, Peter Trei wrote:

>Spry Mosaic really does support SHTTP - you can use it to connect to the
>SHTTP test pages at Terisa and Commercenet without difficulty, once you've
>doped out how to generate and get signed a low-assurance RSA persona
>certificate.

After I posted about it, I did a little more digging and checked out the
S-HTTP portion of the code.  Seems to work pretty well.  (I was a bit
surprised to see that the Personna cert generation saved the information off
in a text file, instead of using the bundled e-mail client.  The docs on
this process were pretty sketchy as well...)

>I just performed an altavista search for references to "shttp://" (the SHTTP
>prefix) and "https://" (the SSL prefix). The results were 1,000 SHTTP
>hits, and 20,000 SSL hits.
>
>SHTTP may be technicly superior to SSL level 2.0, but as a commercial
>software developer, I know on which side my bread is buttered.

My reasons for installing it had little to do with S-HTTP (but it was a nice
bonus) and more to do with the lack of table support.  (I needed something
to check out how pages would look on non-table supporting browsers.)

My concerns with S-HTTP are with the lack of server (and browser) software
support for it, as well as the difficulty of maintaining a site that uses
it.  (Having to change every single page on a site can become a bit of a
chore, as well as introduce unintended security holes due to in improperly
updated page.)

---
Alan Olsen -- alano@teleport.com -- Contract Web Design & Instruction
        `finger -l alano@teleport.com` for PGP 2.6.2 key 
                http://www.teleport.com/~alano/ 
  "We had to destroy the Internet in order to save it." - Sen. Exon