>it's all done, to the extent it is done, at the application layer.
Sometimes true but often not. Encryption can and does happen at various layers of the (OSI) networking stack (Secure Session Layer, Transport Layer Security, Internet Protocol Security).
>That's why telnet and FTP are the way they are.
Those programs are the way they are due to a holdover from the Unix philosophy: do one thing and do it well. Sure, functioning at all was more important than functioning securely. If you ran your connections over a VPN, SSL or IPSec line, the fact that telnet didn't also support encryption would be moot.
The Application layer is for the applications data. If you want to secure the transmission of that data, it shouldn't be up to each and every individual application to support encryption.
This is why things like IPv6 or SPDY/HTTP2 have baked-in encryption below the application layer.
Sometimes true but often not. Encryption can and does happen at various layers of the (OSI) networking stack (Secure Session Layer, Transport Layer Security, Internet Protocol Security).
>That's why telnet and FTP are the way they are.
Those programs are the way they are due to a holdover from the Unix philosophy: do one thing and do it well. Sure, functioning at all was more important than functioning securely. If you ran your connections over a VPN, SSL or IPSec line, the fact that telnet didn't also support encryption would be moot.
The Application layer is for the applications data. If you want to secure the transmission of that data, it shouldn't be up to each and every individual application to support encryption.
This is why things like IPv6 or SPDY/HTTP2 have baked-in encryption below the application layer.