Step 1: Add support to Firefox for encryption when connecting on port 80. Call this HTTP, but have the protocol identical to HTTPS with self-signed cert. You negotiate that when you connect to the web server.
Step 2: Advertise to the community you'll be deprecating unencrypted on port 80 after 2 years time. Ideally, make patches to nginx and apache such that it's a small config change.
Step 3: Change behavior such that:
1. Port 80+old http+no encryption: Show a small warning
2. Port 80+encryption+self-signed cert: No warning. Also, unlocked padlock. "HTTP" in URL. Behavior as for current unencrypted web sites.
3. Port 443+encryption+self-signed cert: BIG SCARY WARNING.
4. Port 443+encryption+cert without identity: No padlock. HTTPS in the URL, but grey, and unlocked padlock.
5. Port 443+encryption+cert with identity: Padlock. Green. Name of organization. Indicated as trusted.
One of the problems with a push like this is that, aside from preventing open web, it also undermines the meaning of a cert. With initiatives like https://letsencrypt.org/, I a cert means I actually don't know who I'm talking to (at least in a legal sense -- I can identify the entity, and take them to court if they rob me).
To answer your question: I'm actually not too unhappy with the current state of affairs. I'd be more happy with the state of affairs I proposed above. I'm very unhappy with the state of affairs Mozilla proposes. I value an open web more than I do an arguably more secure one.
This stuff ain't rocket science. Mozilla has smart people. If it's being done a dumb way, there's a reason for it.
Step 2: Advertise to the community you'll be deprecating unencrypted on port 80 after 2 years time. Ideally, make patches to nginx and apache such that it's a small config change.
Step 3: Change behavior such that:
1. Port 80+old http+no encryption: Show a small warning
2. Port 80+encryption+self-signed cert: No warning. Also, unlocked padlock. "HTTP" in URL. Behavior as for current unencrypted web sites.
3. Port 443+encryption+self-signed cert: BIG SCARY WARNING.
4. Port 443+encryption+cert without identity: No padlock. HTTPS in the URL, but grey, and unlocked padlock.
5. Port 443+encryption+cert with identity: Padlock. Green. Name of organization. Indicated as trusted.
One of the problems with a push like this is that, aside from preventing open web, it also undermines the meaning of a cert. With initiatives like https://letsencrypt.org/, I a cert means I actually don't know who I'm talking to (at least in a legal sense -- I can identify the entity, and take them to court if they rob me).
To answer your question: I'm actually not too unhappy with the current state of affairs. I'd be more happy with the state of affairs I proposed above. I'm very unhappy with the state of affairs Mozilla proposes. I value an open web more than I do an arguably more secure one.
This stuff ain't rocket science. Mozilla has smart people. If it's being done a dumb way, there's a reason for it.