Subject: Re: transaction security in the last mile

From: Ben Laurie <[email-masked]>
Date: Sun, 03 Aug 2008 12:53:16 +0100

Thierry Moreau wrote:
> 
> 
> Eric Rescorla wrote:
> 
>> At Mon, 21 Jul 2008 05:44:25 +0100,
>> Ben Laurie wrote:
>>
>>> Eric Rescorla wrote:
>>>
>>>>
>>>> So, I'm not saying that l-o-f will necessarily work here, but
>>>> I don't think it's necessary to prompt the user. Rather, you
>>>> can just accept the first key you see...
>>>
>>> And prompt them when it changes?
>>
>>
>> Good question. Probably retry via the original channel. I agree it's
>> not a real adequate answer...
>>
> 
> This is the pervasive question for almost all security schemes. How does 
> a client system establish, and then "maintain", trust in a remote party 
> which you (the designer, with your opinion perhaps reflected reflected 
> in a "policy") assume equiped with more skills in IT security management.
> 
> DNSEXT revisits this question because ... because what, I don't know. 
> Actually the question belongs to the IT security community of experts 
> which never addressed the question for what it is, i.e. pervasive for 
> almost all security schemes.

I think the security community has failed to grasp this nettle in many 
areas, not just the "trust" question (I dislike that word, but it is the 
term of art). In practice we've had the cryptographic and protocol 
answers to many security problems for a long time. What we have 
consistently failed to address is the fact that security is actually a 
UI problem, not a technical one.

Cheers,

Ben.

-- 
http://www.apache-ssl.org/ben.html           http://www.links.org/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Duane <[email-masked]>
Date: Sun, 03 Aug 2008 23:57:48 +1000

> areas, not just the "trust" question (I dislike that word, but it is the

Try 'confidence' instead, as I keep saying every time it comes up, the
term 'trust' has been abused by cryptographers for a very long time, and
the term only makes sense after a continued relationship to determine if
you trust the other party or not. After all would you 'trust' someone
with your car or your child just because they have a SSL certificate
that is signed by a company with their root certificate in the browser?

Where as the term 'confidence' you place a level of confidence in seeing
the lock that the connection is encrypted, you have a level of
confidence that most companies, most of the time

> UI problem, not a technical one.

I think things are actually going backwards to be honest, the way
firefox (it's the worst offender now) and other browsers treat invalid
and self signed certs means most if not all people that could benefit
from at least self signed certs don't use any encryption to prevent
pop-up messages from pestering everyone to death.

It really is to the detriment of everyone that some of these snake oil
sales men have pushed things in this direction.

-- 

Best regards,
 Duane