Subject: user security handbook change list

From: Erik Guttman <[email-masked]>
Date: Wed, 16 Sep 1998 12:16:04 +0200 (MET DST)

I wanted to discuss the set of work items we had agreed on at the IETF
meeting.

   draft-ietf-ssh-users-08.txt is the current working draft.

We have identified the following changes for a draft -09 which will
be ready to submit to the IESG for promotion as an informational RFC.

I identify only text changes not small grammar points, such as
changing some 'which's to 'that's, etc.

There are a few places where we still need text.  I tried to supply
something for each place. 

   ***  PLEASE READ THE NEW TEXT CAREFULLY AND SEE IF IT IS OK ***
   ***    I WILL MARK IT WITH '***' IN THE LEFT HAND MARGIN.   ***

 1. Section 3.1: 

   a. An ever expanding wealth of free software has become available 

      becomes

      An ever expanding wealth of downloadable software has become 
      available

   b. Do not, for example, mistake a downloaded program for a common 
      program just because they have the same name.

      becomes

      Do not, for example, mistake a downloaded program for another
      program just because they have the same name.  This is a common
      tactic to fool users into activating programs they believe to 
      be familiar but in fact could dangerous.

   c. You download a game program from an anonymous file server.

      becomes

      You download a game program from an anonymous server.

 2. Section 3.2:  Add the following text to the end:

***   It is possible that a web page will appear to be genuine, but in fact
***   be a forgery.  It is easy to copy the appearance of a genuine web page
***   and possible to subvert the network protocols which contact the desired
***   web server, misdirecting a web browser to an imposter.  

***   In order to meet that threat, it is possible to verify that a web page 
***   is genuine.  This is done using SSL.  The web browser's 'lock' or 'key' 
***   icon indicates a 'secure' page has been downloaded.  It is good to 
***   double check this:  View the 'certificate' associated with the web page 
***   you have accessed.  Each web browser has a different way to do this.  
***   The certificate will list the certificate's owner and who issued it.  
***   If these look trustworthy, you are probably OK.
    
 3. Section 3.3.

   Any way in which a file can find its way onto a computer is possibly
   dangerous.  If the attached file is merely a text message, fine.  But
   it may be more than a text message.  If the attached file is itself...

   becomes:

   Any way in which a file can find its way onto a computer is possibly
   dangerous.  For example, if the attached file is itself...
   
 4. Section 3.9:

   Encryption is also very important if you share a computer.  A home
   computer may be used for preparing taxes and also for playing
   computer games by children.  By backing up the data and using 
   encryption, this kind of shared use may be done safely.

   becomes:

   Encryption is also very important if you share a computer.  
   For example, a home computer may be shared by roomates who are
   friends but prefer to keep their Email and financial information
   private.  Encryption enables shared though private use.
    
 5. Section 3.11:

   For this reason, some centrally-administered sites request that
   certain web browser capabilities be turned off:

   becomes:

   For this reason, some centrally-administered sites require that
   certain web browser capabilities be turned off:
     
 6. Section 5:

   If the machine has a mixed purpose, say recreation, correspondence
   and some home accounting, perhaps you will hazard some downloading of
   shareware applications.  You take some risk of acquiring software
   which is not exactly what it seems to be.

   becomes:

   If the machine has a mixed purpose, say recreation, correspondence
   and some home accounting, perhaps you will hazard some downloading 
   of software.  You take some risk of acquiring stuff which is not 
   exactly what it seems to be.

 7. Glossary changes:

	a. Acceptable Use Policy 

	   add to the term ("AUP", or Terms of Service "TOS")

	b. Authentication

	   this term is required.  How about:

***	   Authentication refers to mechanisms which are used to determine
***	   the identity of someone.  Authentication typically requires a
***	   name and a password to be supplied.

	c. Certificate

	   we need a vernacular, not technical explanation here.  How
	   about:

***	   A certificate is used to verify Digital signatures.  Say an
***	   Email message contains a digital signature that says "I am 
***	   from Bob."  Bob's certificate is used to verify that the 
***	   digital signature is correct.

	d. Clean system

	   this term might be added.   How about:

***	   A computer which has been freshly installed with its operating
***	   system and software, from trusted software distribution media.
***	   As more software and configuration are added to a computer, it
***	   becomes increasingly difficult to determine if it is 'clean' or
***	   has been compromised by viruses, trojan horses or misconfiguration
***	   which reduces the security of the system.

	e. Common Account

	   this term should be called "Shared Account, Sharing" but
	   the text of the term is OK.

	f. (Computer) Account
	
	   Add:  An account provides the end-user access to facilities,
	   services and data.

	g. Cracker

	   Changes to:

***		This term is used to describe attackers, intruders and
***		other bad guys who do not play by the rules and try to 
***		circumvent security mechanisms and/or attack individuals
***		and organizations.

	h. Decrypting

	   "recover the original text" becomes "recover the original data"

	i. Default Account

 	   Add this section. How about:

***	   Some systems and server software comes with preconfigured
***	   accounts.  These accounts may be set up with a predefined
***	   password, which allows anyone access.  Default accounts
***	   should be turned off or their predefined passwords changed
***	   to reduce the risk that the system will be abused.

	j. Digital Signature

	   Consensus was that we want a vernacular not technical definition.
	   How about:

***	   A digital signature is created by a mathematical computer 
***	   program.  It is not a hand written signature, nor a computer 
***  	   produced picture of one.  The signature is like a wax seal
***	   which requires a special stamp to produce it.  A digital
***	   signature is attached to an Email message or file.  It is
***	   later possible to identify the origin of the message or file.

	k. Email Attachment

	   Is adding this term necessary?  The text in the document is
	   pretty clear, right?

	l. Encrypting / Encryption

	   Change to:

	   This is a mathematical process for scrambling data.

	m. Fixes, Patches and installing them

	   Include a new term "Patch" which points to Fixes

	n. Key Escrow      

	   Currently, contentious:

  	   Keys are used to encrypt and decrypt files.  These keys are
   	   legitimately used by parties who have agreed to share data.  If
   	   the keys are available to third parties, this is known as key
   	   escrow.  This may be used to prevent key loss or to allow the
   	   third party (for example, government agencies) to be able to
   	   access the encrypted data.

	   Change to?

***	   Keys are used to encrypt and decrypt files.  Key escrow is
***	   used to store keys for use by third parties to access the
***	   data in encrypted files.

	m. Keys used to Encrypt and Decrypt Files

	   To make use of encryption, an end-user has to provide some 
	   secret, in the form of some data, usually called a key.

	   <omit the rest!>

	n. Logging 

	   This section needed.  How about:

***	   Systems and server software often provide the ability to
***	   keep track of events.  These events are written out to a 
***	   file called a log.  The log file can be read later and 
***	   allows system failures and security breachs to be identified.

	o. Multipart documents

	   Is this term really needed?  The section where these are
	   discussed is pretty clear on what they are.

	p. One Time Password System

	   should be called One Time Passwords

	   The text of this section can be reduced to simply:

	   Instead of using the same password over and over again, a
   	   different password is used on each subsequent log in.

	q. Passphrase

	   Change this to:

	   A passphrase is a long password.  It is often composed of
	   several words and symbols to make it harder to guess.

	r. PPP (Point to Point Protocol)

	   The current definition is no good.  We need another.

	s. Shareware

	   Omit this term entirely.

	t. SSH (Secure Shell)

	   We need to check to see if the term SSH is a trademark.

	   Change the definition to:

	   SSH provides a protocol between a client and server allowing
	   remote access with encryption.

	u. SSL (Secure Sockets Layer)

	   Change the definition to:

***	   This protocol provides security services to otherwise insecure
***	   protocols which operate over a network.  SSL is typcially used
***	   by web browsers to encrypt data sent to and downloaded from a
***	   server.  

	v. Trusted Source

	   omit this term.

 8. Acknowledgments

	change to:

***	   The User Security Handbook was a collaborative effort
***	   of the Site Security Handbook Working Group of the IETF. 
*** 	   Simson Garfinkle provided very helpful feedback on this document.
***	   Bill Woodcock's and Klaus-Peter Kossakowski's contribution to
***  	   the glossary is much appreciated.

Erik

---

From: Klaus-Peter Kossakowski <[email-masked]>
Date: Fri, 18 Sep 1998 20:18:00 +0000

Hi Erik,

I agree with your changes and suggestions beside the points
that follows ... As they are only in the glossary, consider
them minor.

Hey, seems the USH nearly made it :)

Best regards,
	Peter

>***	   name and a password to be supplied.

		... refers to mechanisms which are used to prove
		the identity ...

		determine is too weak from my understanding. It is really
		that someone can prove that the identity he claims to be
		really is he (very bad english, sorry)

>***	   digital signature is correct.

		A certificate is a digital signature on a public key
		of a user. Say an Email message contains a digital signature
		that says "I am from Bob." Bob´s key is used to verify that
		these digital signature is correct. But without getting the
		key from Bob directly, users have to rely on certificates
		certifying that the key actually belongs to Bob.

Klaus-Peter Kossakowski, Germany
Phone: (+49) 0171 / 5767010  Fax: (+49)02504 / 729420
[email-masked]                  PGP: 0x38B56E3D/2048/RSA