Re: [Add] Browser Administrative Authority

["Livingood, Jason" <[e-mail]>]

Adding to what Vittorio said, some research I have seen suggests that people's movements are much less variable that you may think - we are creatures of habit. Most people may only be on their home network, their work network, their 4G/5G network, and maybe 1 other WiFi network (e.g. coffee shop) on the average day. In situations like the coffee shop - or a random airport WiFi - they would know trust is lower and can optionally use a VPN -- or at least feel safe in the knowledge that their web transaction is likely encrypted (which is >90% of user time on the web these days IIRC).

JL



On 5/27/19, 5:25 AM, "Add on behalf of Vittorio Bertola" <[e-mail] on behalf of vittorio.bertola=[e-mail]> wrote:

    > Il 24 maggio 2019 21:23 Tom Ritter <[e-mail]> ha scritto:
    > 
    > The network should be considered hostile until configured otherwise
    > because... the network usually is hostile. Or at least it's untrusted.
    > Every cellular connection; every coffee shop, every store's free wifi,
    > every friend's network you connect to, every AirBnB wireless, every
    > hotel... Percentage-wise, the number of untrusted networks the average
    > user connects to dwarfs the number of trusted networks (even if the
    > percentage of time spent on untrusted networks is dwarfed by the
    > percentage spent on trusted networks.)
    
    There definitely is a security/privacy issue for people and devices that roam a lot and it's fine to address it, but IMHO this is the view you get from a specific viewpoint and does not represent the full picture or even the best part of it. There are tons of people/devices that do not move and only use the Internet from a single trusted network, usually a home/corporate one, and rely on it for security. As a subset of this, there also is an increasing number of cases in which the user controls the network much more than the device: think of all the IoT stuff that you buy and deploy at home, but which is really a black box to you - unless you can use your local network administrator power to exert at least some control on their traffic.
    
    Perhaps this should lead to different control hierarchies and policies for roaming devices (e.g. mobile phones) than those for the rest of the world. More generally, this is what makes the ADD issues hard: different use cases have conflicting requirements. Perhaps, part of the work could be documenting the appropriate control hierarchies in different situations, as Glenn did, and then see if there are ways to reconcile the conflicts - and I suspect these are going to be by policy and user interaction, rather than by technical instruments.
    
    Ciao,
    -- 
     
    Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
    [e-mail] 
    Office @ Via Treviso 12, 10144 Torino, Italy
    
    -- 
    Add mailing list
    [e-mail]
    https://www.ietf.org/mailman/listinfo/add