Re: [Endymail] Secure universal message addressing

Natanael <natanael.l@gmail.com> Mon, 04 April 2016 18:11 UTC

Return-Path: <natanael.l@gmail.com>
X-Original-To: endymail@ietfa.amsl.com
Delivered-To: endymail@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0636812D768 for <endymail@ietfa.amsl.com>; Mon, 4 Apr 2016 11:11:25 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.699
X-Spam-Level:
X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pCdZ0DdkkR38 for <endymail@ietfa.amsl.com>; Mon, 4 Apr 2016 11:11:18 -0700 (PDT)
Received: from mail-lf0-x244.google.com (mail-lf0-x244.google.com [IPv6:2a00:1450:4010:c07::244]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D5C5012D134 for <endymail@ietf.org>; Mon, 4 Apr 2016 11:11:17 -0700 (PDT)
Received: by mail-lf0-x244.google.com with SMTP id e190so5091492lfe.1 for <endymail@ietf.org>; Mon, 04 Apr 2016 11:11:17 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc; bh=w5cWuWjsr8JLTgsBbTy/lmJxMdTqHusEeSTTAvTXWtI=; b=fcXsKBwfti0RU9/F/i1o4jrsCk+48XjF5xH4Uq+BfPiEpNgABwWQgFNY1NwCiY6cbf nCE55B6US/k2ZKw8VgB2ogiq2Fej4fItjuSfcIoe2iV3/qEY/HP27PIkX/6PrE92rjBg LDx5NBwwUsy4JUvJ7okJudpiYPEDKUPVYazFItdCMvTUS0J9DOBTC6acVCKwbWqCVr6L bdQsMqjN46eLuLKz1RLgoIXwzfF1Ip3Pl7ss46vr79RJ6HdZcjrMCw93PI5ybt6GetpR owDEQsZV8gLWJghYt4dDaZ8ZPzy+I/rbDeCfAtawnFsDEXfJ795pMM4a/9FWE/m03c5I 5IhA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc; bh=w5cWuWjsr8JLTgsBbTy/lmJxMdTqHusEeSTTAvTXWtI=; b=k9l4lDRbM+jqe6ukk/1L1OdGDIyS3SxIGuK+nW6JNdpAREkxG6Y+5/M5N5ArSHJnWF uoB3FE2rFSRaoZmt7Yl1CUm/h1ctDoM80o10rwSnW5aeksRFPiOG4DHCm60haqUvkOjC l/dhD1279+7UelLl5NUZbfsLdPED/vI/FNw9o2UiunNWt4KrFDwwcY4JAB4npI6TRLTe x0768ohl6ANieqheG8uq2xJY85MbSGW5cmut4NmUkVjzHAWXGU8k74FAN0zYIhZ0Kknb 4E2SoHaphDD0z6a0pEH/nCuqjFsiNtJAvyTSKmzgyoEWOuacWRJ9vEgEKY6LlRhoi3D7 qa3w==
X-Gm-Message-State: AD7BkJJmQaNP7V9riKArCs/JL1WMWnWbYZoxxzTQE7J1WqqGczvPLu1K7BHgaFF+R3I8SK/YrheXM+l0GWT2vA==
MIME-Version: 1.0
X-Received: by 10.194.171.130 with SMTP id au2mr14060728wjc.99.1459793475989; Mon, 04 Apr 2016 11:11:15 -0700 (PDT)
Received: by 10.194.23.195 with HTTP; Mon, 4 Apr 2016 11:11:15 -0700 (PDT)
Received: by 10.194.23.195 with HTTP; Mon, 4 Apr 2016 11:11:15 -0700 (PDT)
In-Reply-To: <9FC3BDD6-5246-4842-A6A4-FE272B0BACA3@seantek.com>
References: <CAAt2M1-qLf7HF_zTSgWGH4TKmOuYZH6h9iXL=+JzSwdfk1+HqQ@mail.gmail.com> <CAAt2M1-AtpmREOi1Ex+sLjUqZtbcDOUC_zGd4u5Ot1cW+UT5ug@mail.gmail.com> <CAAt2M18W+k_bNL+WV1pa7dnbgzuThFqrqMcwVk5C20M-b_PrTg@mail.gmail.com> <CAAt2M19ThO-J3awEbKfx--mtpssB-Qk+5rHCcoBD57vytucvMw@mail.gmail.com> <CAAt2M19amebwCsdiNAqrBCD6OwGCUJCpKYkU7kvnRSafywTC=w@mail.gmail.com> <CAAt2M1-HOUjWLZOZycfcmGCgD+DkvsAOzjkd4bCuSjhSLVyDgw@mail.gmail.com> <CAAt2M1_C7OJZLZW7AnK1sYAK9ANpRS-FQ1__guKT7_Zacun+BA@mail.gmail.com> <CAAt2M19TiwGMmtsNyAWwaRk5Kup0for_AV0C=AFd--+kmUYcDw@mail.gmail.com> <CAAt2M19MWW-4CAoCejwYEZm-YzJ6UUWypeBtfPbWLh0ka=Ta8A@mail.gmail.com> <9FC3BDD6-5246-4842-A6A4-FE272B0BACA3@seantek.com>
Date: Mon, 04 Apr 2016 20:11:15 +0200
Message-ID: <CAAt2M1-6Q6542qms82XizEt+Wi7KU4=LF8Ws5-U-25Q4QJyRaw@mail.gmail.com>
From: Natanael <natanael.l@gmail.com>
To: Sean Leonard <dev+ietf@seantek.com>
Content-Type: multipart/alternative; boundary="089e011773ef94fab6052faca7f8"
Archived-At: <http://mailarchive.ietf.org/arch/msg/endymail/N5jj-erN_KS59SFuq5jINpkhwLQ>
Cc: messaging <messaging@moderncrypto.org>, Cryptographers List <crypto-practicum@lists.sonic.net>, Cryptography Mailing List <cryptography@metzdowd.com>, Crypto List <cryptography@randombit.net>, endymail <endymail@ietf.org>
Subject: Re: [Endymail] Secure universal message addressing
X-BeenThere: endymail@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: <endymail.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/endymail>, <mailto:endymail-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/endymail/>
List-Post: <mailto:endymail@ietf.org>
List-Help: <mailto:endymail-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/endymail>, <mailto:endymail-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 04 Apr 2016 18:11:25 -0000

Den 4 apr. 2016 19:23 skrev "Sean Leonard" <dev+ietf@seantek.com>:
>
> I think it’s called a URI.
>
> Any “universal” address is going to have to have embedded info about the
protocol or system that it is addressing. See URI.

People see URL:s and think websites, they see email addresses and think
people.

OpenID essentially died. So did Mozilla's Personas. A bunch of RDF based
protocols too. And many many more. They all shared the URI. It was
*something extra* people has to remember and share besides their email.

If we're going with an URI, what do we put in the protocol field? Do we go
for a magnet link type address where you encode an URL in the URI if you're
using a server, and otherwise specify a protocol and public key, etc? Next
question, the more serious one; who'll even try to share that URI? Who's
gonna read it over the phone? Exactly nobody. It will be forgotten.

Or do we go with HTTP + special HTML tags on websites like OpenID did and
go for standard URL:s? Besides the tendency of HTML tags to get broken in
website redesigns, the total lack of an enforceable standard for how
transparency logs could be implemented (how will you even know where these
tags can be found on arbitary domains, since few will accept using your
page naming conventions?), HTML parsers tend to have bugs.

Also, that situation would also practically by default lead to developers
forgetting about other lookup/connectivity protocols, like Namecoin and
I2P, where their addresses won't even be recognized.

That's why I stick to email addresses here. We can actually enforce a
secure way to implement the lookups if we use them.