Subject: Re: WG Review: Open Pluggable Edge Services (opes)

From: Vernon Schryver <[email-masked]>
Date: Wed, 20 Jun 2001 08:12:49 -0600 (MDT)

> From: Jeffrey Altman <[email-masked]>
> To: Paul Hoffman / IMC <[email-masked]>
> Cc: [email-masked], [email-masked]

> > As for the argument about "TLS everywhere", you have to ask who is 
> > going to pay for it. The end-user cannot demand it; only the server 
> > can. TLS is universally available today, and servers rarely use it 
> > for anything other than getting credit cards or passwords.
>
> Servers do not use it for everything because the cost of using TLS
> with X.509 certificates from an entity such as Verisign are on the
> order of $700 per server per year per hostname.

THe last time I checked Verisign's prices they were on the order of
$250/year/hostname.  I think that's about 100 times too expensive
given the uselessly superficial checking of the identity of 
outfit buying the certificat (and I was saying that before the
recent Microsoft circus.)

>                                                  Why should anyone be
> required to pay such an outrageous tax simply to be able to protect
> their home photo collection from being tampered with in transit to 
> a visitor's browser?
>
> Granted, we could all become our own CAs, but that scares end users
> and reduces the trust model because we don't want to train users to
> accept a new CA cert from every site they go to.  

No, on several counts:

  1. The only reason that might scare end users is because of scary
    words from browsers, and then only for HTTP.  Browsers are not
    too-smart-by-half SMTP MUA's not SMTP servers.  There are no scary
    CA pop-ups from your browser-broken-MUA if you use SMTP for mail
    submission.

  2. there are no pop-ups, scary or otherwise, when you and other
    SMTP client and server operators exchange certs for sendmail's use.

  2. becoming your own CA is easy, once someone tells you the magic
    Openssl incantation.  

  3. a web of CAs could work similarly to the PGP web of trust.

No, the reason people are not using TLS everywhere is that they don't,
not even here, about avoiding the data muggers.  The rest, including
the poor documentation of what to do in sendmail 8.12, are just excuses.

Vernon Schryver    [email-masked]

---

From: Adam Shostack <[email-masked]>
Date: Wed, 20 Jun 2001 12:06:28 -0400

On Wed, Jun 20, 2001 at 08:12:49AM -0600, Vernon Schryver wrote:
| >                                                  Why should anyone be
| > required to pay such an outrageous tax simply to be able to protect
| > their home photo collection from being tampered with in transit to 
| > a visitor's browser?
| >
| > Granted, we could all become our own CAs, but that scares end users
| > and reduces the trust model because we don't want to train users to
| > accept a new CA cert from every site they go to.  
| 
| No, on several counts:
| 
|   1. The only reason that might scare end users is because of scary
|     words from browsers, and then only for HTTP.  Browsers are not
|     too-smart-by-half SMTP MUA's not SMTP servers.  There are no scary
|     CA pop-ups from your browser-broken-MUA if you use SMTP for mail
|     submission.
| 
|   2. there are no pop-ups, scary or otherwise, when you and other
|     SMTP client and server operators exchange certs for sendmail's use.
| 
|   2. becoming your own CA is easy, once someone tells you the magic
|     Openssl incantation.  

Unfortunately, the become your own CA solution doesn't actually help
deal with the issue of man-in-the-middle attacks.  The threat under
discussion is that there is a proxy modifying content; we'd like to
prevent that.  If the server sends a key without reference to some
established authority, then the MITM may simply replace that key with
one of its own, or translate the http-over-SSL request into a
cleartext http request, or otherwise munge the session, because there
is no way for the browser to figure out if the self-signed key is the
one the server sent.

(I find it unfortunate because often, become your own CA is a good 
idea, and this is one of the few cases where its not.)

Adam

-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume

---

From: "Manoj Dhooria" <[email-masked]>
Date: Thu, 21 Jun 2001 17:21:57 +0530

Becoming your own CA: Some interesting discussion on it in Tim Berners-Lee's
recent book - "Weaving the Web" - I think a whole chapter on this subject -
most of it in line with the discussion on this thread in the past few days.

Real bottleneck is - how the hell does an arbitrary web service exchange
identity securely with an arbitrary client on the public web? When you
depend on this identity (call it certificate, or whatever) to actually
encrypt data.

Manoj Dhooria
Geometric Software, Bombay.

-----Original Message-----
From: Adam Shostack [mailto:[email-masked]]
Sent: Wednesday, June 20, 2001 9:36 PM
To: Vernon Schryver
Cc: [email-masked]; [email-masked]
Subject: Re: WG Review: Open Pluggable Edge Services (opes)

Adam

---

From: Kevin Farley <[email-masked]>
Date: Thu, 21 Jun 2001 06:59:17 -0700 (PDT)

I apologize for asking, but...

I have been reading the ietf-opes.org pages again and I still can't get
a good hold on what OPES is trying to accomplish. There are a lot of
drafts listed on the site that discuss several scenarios like content
peering, edge caching, etc., and while that's all nice and everything,
someone please tell me why OPES is trying to lump all of this stuff
together.

Would an OPES-proponent please illustrate the advantage of OPES with 1
or 2 example services that are not already in existence today (meaning
not edge caching and not distributed content servers) that would
benefit end users?

-Kevin

__________________________________________________
Do You Yahoo!?
Get personalized email addresses from Yahoo! Mail
http://personal.mail.yahoo.com/