Re: [http-auth] [saag] re-call for IETF http-auth BoF

[Nico Williams <[e-mail]>]

On Mon, Jun 6, 2011 at 5:33 PM, Marsh Ray <[e-mail]> wrote:
> On 06/06/2011 04:44 PM, Nico Williams wrote:
>>
>>  But I'm afraid
>> that the appearance of success will be enough to staunch progress in
>> any other areas, so it may be a now-or-never situation for any
>> alternatives other than JavaScript crypto APIs.
>
> Don't worry about it, they're not going to work even that well.

I know they won't work.  That's not my fear.  My fear is that they
will seem to be enough of an improvement over the current mess that we
declare victory and go home, leaving us with a serious failure.

> They wouldn't have stopped the government of Tunisia from MitMing Facebook
> and inserting Javascript to modify the behavior of the page. They wouldn't
> have stopped the government of Syria from using a BlueCoat to perform SSL
> MitM on Facebook with a bogus self-signed cert either.

Right.

> Both governments were arresting and shooting their citizens and hacking
> their Facebook credentials. Interestingly, Tunisia controls a trusted root
> CA but didn't bother to use it. Syria doesn't control a widely trusted CA,
> but doesn't seem to need it either.
>
> Sooner or later, people will tire of security theater. We can just try to
> have the best options available when they do.

Having them available means having implementations and deployments of
code done.  That's also the hardest part.

Nico
--