Re: [98attendees] Tussle issue in plenary

[Bron Gondwana <[e-mail]>]

On Thu, 30 Mar 2017, at 02:09, Davey wrote:

> Note that I say this not because I endorse the censorship of gov't or
> encourage any activities violating privacy. They are just there no
> matter you like it or not, similar as that you can not decide who is
> your president.


I absolutely agree, and as I said (I was the last person up to the
microphone), the people who want to do these things have real world
actual authority and power.  They _will_ route around our protocols if
they have to.


#include <xkcd/538.gif>



And the idea of a TLS connection that negotiates in a third party with
rights to watch or even alter traffic in a standard way sounds better to
me than an interception box that terminates your connection with their
own cert that you are required to add to your browser, and then makes an
additional connection onwards:


https://www.us-cert.gov/ncas/alerts/TA17-075A



If there was a standard which avoided "The client can only verify the
connection between itself and the HTTPS interception product. Clients
must rely on the HTTPS validation performed by the HTTPS interception
product." then everybody behind one of those boxes would overall be
safer.  Sure it's worse than having nobody evesdropping, but at least
you know who's listening.


Bron.



--

  Bron Gondwana

  [e-mail]