1. Browsers don't send singular messages containing anonymous information.  They send a complex
2. sequence of messages to multiple parties with an interaction pattern and communication state.
3. The more complex and encrypted the communication, the more uncommon state and direct
4. communication is required, which makes it easier to track a person across multiple requests
5. until the user's identity is revealed.  Furthermore, with TLS in place, it becomes easy and
6. commonplace to send stored authentication credentials in those requests, without visibility,
7. and without the ability to easily reset those credentials (unlike in-the-clear cookies).
8.  
9. Padding has very little effect.  It isn't just the message sizes that change -- it is all
10. of the behavior that changes, and all of the references to that behavior in subsequent
11. requests, and the effects of those changes on both the server and the client.
12.  
13. TLS does not provide privacy.  What it does is disable anonymous access to ensure authority.
14. It changes access patterns away from decentralized caching to more centralized authority control.
15. That is the opposite of privacy.  TLS is desirable for access to account-based services wherein
16. anonymity is not a concern (and usually not even allowed).  TLS is NOT desirable for access to
17. public information, except in that it provides an ephemeral form of message integrity that is
18. a weak replacement for content integrity.
19.  
20. If the IETF wants to improve privacy, it should work on protocols that provide anonymous
21. access to signed artifacts (authentication of the content, not the connection) that is
22. independent of the user's access mechanism.
23.  
24. I have no objection to the IESG proposal to provide information *also* via https.  It would
25. be better to provide content signatures and encourage mirroring, just to be a good example,
26. but I don't expect eggs to show up before chickens.  However, I agree with Tony's assessment:
27. most of the text is nothing more than a pompous political statement, much like the sham of
28. "consensus" that was contrived at the Vancouver IETF.
29.  
30. TLS everywhere is great for large companies with a financial stake in Internet centralization.
31. It is even better for those providing identity services and TLS-outsourcing via CDNs.
32. It's a shame that the IETF has been abused in this way to promote a campaign that will
33. effectively end anonymous access, under the guise of promoting privacy.
34.  
35. ....Roy