Re: [98attendees] Tussle issue in plenary

If two parties want and explicit opt to add a third party to their
communication, the network should allow them to do it.
If we can do it without enabling undesired interception, that's a better
and safer network than what we have. It enables the "tussle" that David
Clark and others talk about
<http://david.choffnes.com/classes/cs4700fa14/papers/tussle.pdf>.

It's well known that the existing means for third-parties to add
functionality to encrypted channels significantly reduces security.
Examples:

   - https://zakird.com/papers/https_interception.pdf
   -
   https://www.ftc.gov/system/files/documents/public_comments/2016/09/00019-129028.pdf

That's very different from undesired interception. Whether previous
proposals were bad, that's not a reason to give up. There are so many
brilliant people at IETF that I'm sure a good solution can be achieved. But
that cannot happen if the attitude is to dismiss attempts without even
talking.

Stephen refers to previous discussions. Has any working group ever created
a document that analyzes and formalizes the arguments for and against
adding third-parties to private conversations? Maybe that's something that
should precede any proposal to solve the problem. A statement of security
and privacy requirements should help too.

Vinicius Fortuna

On Fri, Mar 31, 2017 at 9:39 AM Stephen Farrell <stephen.farrell@cs.tcd.ie>
wrote:

>
>
> On 31/03/17 07:43, Bron Gondwana wrote:
> > And the idea of a TLS connection that negotiates in a third party with
> > rights to watch or even alter traffic in a standard way sounds better to
> > me than an interception box that terminates your connection with their
> > own cert that you are required to add to your browser, and then makes an
> > additional connection onwards:
>
> Yuk. Been debated and failed. Proposals were made and turned
> out crap. We shouldn't go there.
>
> Please check the archives of httpbis, tls and saag for those
> recurring discussions before proposing something.
>
> S.
>
> _______________________________________________
> 98attendees mailing list
> 98attendees@ietf.org
> https://www.ietf.org/mailman/listinfo/98attendees
>