Subject: [therightkey] As for MITMs, authentication with channel binding would defeat them

From: Nico Williams <[email-masked]>
Date: Thu, 9 Feb 2012 11:35:24 -0600

The only thing missing, of course, is web user authentication
technologies that scale to the Internet and have channel binding
support.

I would like to see web userauth technologies that have support for
channel binding.

If such technologies were in widespread use then MITM CAs would be
useless, therefore rare.

Is it too late to work on this?  The folks over at the ABFAB WG don't
seem to think so, but I want more options than just Project Moonshot
and Kerberos.

Nico
--

---

From: Yoav Nir <[email-masked]>
Date: Fri, 10 Feb 2012 01:04:10 +0200

> seem to think so, but I want more options than just Project Moonshot

This thread looks to me like it's more appropriate for the http-auth mailing list. The "charter" of therightkey is pretty specific in that it talks about PKI authentication only.

This will be a one-time-only cross-post.

Yoav

---

From: Nico Williams <[email-masked]>
Date: Thu, 9 Feb 2012 17:14:48 -0600

The relevance to PKI is that those MITM CAs wouldn't be such a big
deal if they were useless.  If anyone wants to continue down the "how
to get CB deployed" I agree we should continue on the http auth list.