Re: [arch-d] ipv4 and ipv6 Coexistence.

[Toerless Eckert <[e-mail]>]

On Wed, Feb 26, 2020 at 10:45:29AM +0000, Stephen Farrell wrote:
> On 26/02/2020 10:21, Stewart Bryant wrote:
> > "The head of MI5 has urged technology companies to give the security
> > services â?????exceptionalâ??? access to encrypted messages 
> 
> And in other, equally shocking, news: the sun will rise tomorrow;-)

https://en.wikipedia.org/wiki/The_empire_on_which_the_sun_never_sets
;-))

> If you do want to rehash the cryptowars debate again,

Not at all. But for example enterprises often use HTTPs proxies
for firewalling, intrusion detection, proprietary data leakage
prevention and the like. I am not aware we have stablished standards
for such desirable behavior. In fact there are issues with the expected
end-to-end krypto security when you bring in such trusted middle-men.
(e.g.: undesirable cert spoofing). There are no browser standards
for a three party trust-model AFAIK.

Right now, we have only those global commercial players positioning
them as trusted third parties. Even DoH IMHO falls into this play.
And then selling customer data collected, at least when they have
some entity operating outside europe (GDPR data leakage prevention).

All those IoT devices that export unbeknownst do the user all type
of collected user data to a cloud. We could come up with mandatory
published data models, force the connection through a trusted third
party device that can then do semantic filtering. Aka: i rather
want to be able to control than just trust GDPR statements.

Likewise i think we could define better behaving firewall policies
in the fashion did it for NAT with BEHAVE, e.g.: more visibility
of policy for better diagnostics.

Etc. pp. Just brainstorm what positive evolution we could promote
through IETF work for more security. The IETF end-to-end encryption
laurels nice but not enough.

> maybe at least change the subject line? If doing so,
> and I hope you decide not to, because there's no gain,
> please recognise that there are many (me included) who
> do not share the views you quoted for sound technical
> reasons (e.g. [1] is perhaps the most-cited recent
> paper on that) that have garnered rough consensus in
> the IETF every time we've done that rehashing.

Stating that we would like to see IETF solve problems doesnt
mean we agree to those regurgitated security agency memes.
Instead, i see these memes as the real risks, because the
public has shown to give in to the ongoing "tough on crime"
pounding with really bad outcomes. So we really need better,
alternative models for more security in addition to the
ongoing push back against that type of nonsense.

Cheers
    Toerless

> S.
> 
> [1] Abelson, Harold, et al. "Keys under doormats: mandating insecurity
> by requiring government access to all data and communications." Journal
> of Cybersecurity 1.1 (2015): 69-79.
> https://www.cs.yale.edu/homes/jf/paper-keys-under-doormats-CSAIL.pdf
> 
> 
> 
> 
> 

pub   RSA 4096/7B172BEA 2017-12-22 Stephen Farrell (2017) <[e-mail]>
> sub   RSA 4096/36CB8BB6 2017-12-22
> 




> _______________________________________________
> Architecture-discuss mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/architecture-discuss


-- 
---
[e-mail]