Subject: [104attendees] Rust programmer help?

From: Tom Pusateri <[email-masked]>
Date: Mon, 25 Mar 2019 05:11:58 -0400

Can anyone here at IETF offer some Rust programming assistance? I’m stuck on an Arc Mutex + Send issue.

Tom

---

From: Anders Rundgren <[email-masked]>
Date: Tue, 26 Mar 2019 16:44:31 +0100

As you probably know QR won the Mobile to PC/Web ad-hoc connection war.

A secure and convenient replacement is Bluetooth but it only works satisfactory for fully integrated solutions like FIDO/WebAutn or ApplePay.  Having to grant every merchant out there access to your PC/BLE doesn't scale.

Drop me a line if this topic is of interest.  We are talking about a billion+ users of payment and identity solutions.

Right, NFC isn't shipping in PCs anymore.  It *might* change.

Anders /Staying in Prague til Thursday afternoon.
+33 644 75 23  31

---

From: Yoav Nir <[email-masked]>
Date: Tue, 26 Mar 2019 18:01:13 +0100

> On 26 Mar 2019, at 16:44, Anders Rundgren <[email-masked]> wrote:
> 

Sounds interesting. But what’s wrong with QR?

One great advantage of QR is that it uses the phone camera, so you can can aim your phone and not have a risk of pairing with the wrong device.  This is much more intuitive than matching the numbers in the UI of the phone and the device like you sometimes need to do in Bluetooth.

Yoav

---

From: Olli Vanhoja <[email-masked]>
Date: Tue, 26 Mar 2019 19:13:58 +0100

> One great advantage of QR is that it uses the phone camera, so you can can aim your phone and not have a risk of pairing with the wrong device.  This is much more intuitive than matching the number…

On the other hand, I hate to point my macbook's webcam on a QR code,
done that a few times.

---

From: Anders Rundgren <[email-masked]>
Date: Tue, 26 Mar 2019 20:24:57 +0100

> Sounds interesting. But what’s wrong with QR?

Good question!

+ availability (for the ecosystem)
+ simplicity (for the SP)

- Need to start a dedicated application.
- No secure binding from the Web page and the QR making it impossible creating a "phish-free" OOB auth.

Who uses OOB-based auth and payment solutions? The mentioned billion+ users.

> One great advantage of QR is that it uses the phone camera, so you can can aim your phone and not have a risk of pairing with the wrong device.  This is much more intuitive than matching the number…

I have proposed a browser-based Secure URL / NFC "QR-killer" where the driver would only activate NFC for URLs which has the same security context (https/hostname) as the calling Web page.  The URL may start dedicated applications as well.

I'm not (at all) an expert on NFC but fairly good at app-level security protocols so I believe that you actually can create a secure OOB auth solution.  If somebody wants to verify/challenge my claim I would be extremely happy!

Anders
https://github.com/cyberphone/qr-replacement#a-better-qr