Re: [apps-discuss] [saag] [websec] [kitten] HTTP authentication: the next generation

John C Klensin <> Fri, 17 December 2010 11:09 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 1C3F23A6AE1; Fri, 17 Dec 2010 03:09:35 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -102.874
X-Spam-Status: No, score=-102.874 tagged_above=-999 required=5 tests=[AWL=-0.275, BAYES_00=-2.599, USER_IN_WHITELIST=-100]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id lDpbY0xUl6Tg; Fri, 17 Dec 2010 03:09:34 -0800 (PST)
Received: from ( []) by (Postfix) with ESMTP id 103673A6AE0; Fri, 17 Dec 2010 03:09:34 -0800 (PST)
Received: from [] (helo=localhost) by with esmtp (Exim 4.34) id 1PTYDQ-0004Hs-Dd; Fri, 17 Dec 2010 06:11:12 -0500
X-Vipre-Scanned: 07A7194C001DEB07A71A99-TDI
Date: Fri, 17 Dec 2010 06:11:11 -0500
From: John C Klensin <>
To: Peter Gutmann <>
Message-ID: <97844CCF96DABB3B5F2A976F@[]>
In-Reply-To: <>
References: <>
X-Mailer: Mulberry/4.0.8 (Win32)
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Subject: Re: [apps-discuss] [saag] [websec] [kitten] HTTP authentication: the next generation
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: General discussion of application-layer protocols <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Fri, 17 Dec 2010 11:09:35 -0000

--On Friday, December 17, 2010 6:18 PM +1300 Peter Gutmann
<> wrote:

> John C Klensin <> writes:
>> We could round up a collection of UI experts to look at some
>> of these things  and have them shake their heads and say
>> "royal mess you have gotten yourselves  into".
> The problem isn't that UI experts haven't looked at this,
> there have been a  large number of papers published on this
> problem over the last decade or so,  it's that it's proven
> pretty much impossible to get any action taken over it.  The
> browser approach is "PKI isn't working, so we'll respond with
> even more  PKI (EV certs) while stridently ignoring any
> workable alternatives (TLS-SRP  and -PSK)", and there's no
> sign that this will ever change.  There simply isn't a hammer
> big enough to force a change here (or, if there is, no-one's
> managed  to identify it yet).

I perhaps should have said "...yet another collection of UI
experts..." and "shake their heads again...".

But I don't think we disagree: from my point of view, you are
just describing some aspects of what I tried to summarize as
"royal mess".   I do think there is at least one big enough
hammer although I'm not predicting we will get there soon and
really don't like seeing protocols designed by a sequence of
disaster, legal action, and legislation.  And, I am not, for the
record, offering an opinion as to whether the approaches you
suggest are workable and/or the right answers.