Subject: Re: [TLS] fyi: (HTTP) Strict Transport Security and HASMAT

From: "Jeffrey A. Williams" <[email-masked]>
Date: Thu, 1 Jul 2010 15:33:21 -0500 (GMT-05:00)

marsh and all,

  I fully agree with your remarks and comments below
Marsh.  What's amazing to me is that there seems to be
a culture that either doesn't care much about good
security or isn't willing to do the little bit of extra 
work to effect same.  Still I FWIW, thought your remarks
well execellent.

-----Original Message-----
>From: Marsh Ray <[email-masked]>
>Sent: Jul 1, 2010 3:22 PM
>To: [email-masked]
>Cc: [email-masked]
>Subject: Re: [TLS] fyi: (HTTP) Strict Transport Security and HASMAT
>
>On 07/01/2010 01:13 PM, Martin Rex wrote:
>> Peter Saint-Andre wrote:
>>>
>>> There are several CAs that provide no-cost certificates. The old line
>>> about needing to pay to get on the secure web is obsolete.
>>
>> IPv4 address space is depleting and due to the lack of support for
>> TLS extension SNI (server name indication) in still>40% of the
>> internet user population, this rules out virtual hosting and you
>> will need to get a seperate IP-Address.  These requirements als
>> rule out the really affordable web-hosting services, so you'll
>> start at 10x the monthly fee if you want to offer a public
>> Webserver today compared to the basic service of a
>> virtually hosted Web-Server with your own domain name.
>
>We do what we can, but it's not reasonable to expect grade-A security 
>without incurring at least a little per-unit costs. If, in fact, one can 
>serve globally trusted HTTPS site for only the cost of a CPU and a 
>routable IP then I'd say the technology can be declared a success.
>
>Contrast this with, say, classic FTP where the client also was assumed 
>to have a routable IP.
>
>Contrast this to the classic telephone system where you have to pay a 
>monthly flat rate tax bill just to join the network. If you want to add 
>end-to-end encryption it's probably going to have big up-front costs and 
>won't even be that strong, if you're even permitted to own it. It's not 
>likely to even be possible globally.
>
>Don't get me wrong, I think the ideal cost for a minimal secure site 
>should approach zero. In the case of a secure site, you want and need a 
>trusted party that will do a good job verifying your claim to the 
>identity (and conversely prevent others from falsely claiming the same). 
>This requires a little bit of human effort to do properly.
>
>What would folks have thought in 1995 if told that today the predominant 
>cost of deploying an https site was just the use of the IP address?
>
>I pay $20 per month for hosting and get that one IP along with plenty of 
>CPU and net usage. Additional IPs are... $1 per month.
>
>And yet, I still haven't set up SSL/TLS on that server. I admit it, I 
>use SSH tunnels rather than TLS to encrypt my personal IMAP and SMTP 
>connections. It's a little extra work to sign up for a proper cert and 
>secure it all properly and my little blog doesn't seem worth it. That's 
>probably where the real costs come from, security will always take just 
>a little extra work.
>
>- Marsh
>_______________________________________________
>TLS mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/tls

Regards,

Jeffrey A. Williams
Spokesman for INEGroup LLA. - (Over 300+k members/stakeholders and growing, strong!)
"Obedience of the law is the greatest freedom" -
   Abraham Lincoln

"Credit should go with the performance of duty and not with what is very
often the accident of glory" - Theodore Roosevelt

"If the probability be called P; the injury, L; and the burden, B; liability
depends upon whether B is less than L multiplied by
P: i.e., whether B is less than PL."
United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
===============================================================
Updated 1/26/04
CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of
Information Network Eng.  INEG. INC.
ABA member in good standing member ID 01257402 E-Mail [email-masked]
Phone: 214-244-4827