Re: [EAT] [Rats] Rats and EAT

[Yaron Sheffer <[e-mail]>]

On 12/07/18 19:20, Laurence Lundblade wrote:
> On Jul 11, 2018, at 5:46 PM, Michael Richardson <[e-mail]> wrote:
>>
>> Laurence Lundblade <[e-mail]> wrote:
>>> NEA is oriented around network management, trying to track the security
>>> posture of devices in an enterprise's network. EAT is broadly targeted
>>> at establishing trust between entities, often consumer devices (phones,
>>> refrigerators, cars...) and servers/services (online banking, IoT
>>> services, enterprise authentication…).
>> That's a surprising claim that EAT is going to broker trust between my phone
>> and my refrigerator.    Will it do this via third parties, or directly?
> This is not any direct goal of EAT. Let me say it better:
>
> EAT is broadly targeted at providing some basis for establishing trust in scenarios like this:
>   - An online banking website trusting the phone and app used to show account balance
>   - A Fortune 500 corp trusting the phone and web browser to allow access to corp data
>   - An IoT backend trusting some refrigerators that it is to provide service to (e.g. shopping, milk expiration…)
>
> Maybe someday EAT will be part of a phone-fridge trust solution, but one step at a time.
>
I don't see how in this day and age we can consider a solution that 
covers IOT and phones but not other devices that run an operating 
system, such as laptops and servers.

So maybe NEA was too complex or ambitious, and we should scale these 
ambitions down. But desktops and servers, both physical and virtual, 
should be in scope.

Thanks,
     Yaron