Re: [http-auth] Barry Leiba's Discuss on draft-ietf-httpauth-hoba-09: (with DISCUSS and COMMENT)

Stephen & Barry,

Thank you both for working through this.  I'm caught up now as I was
asleep during the exchange.  I want to make sure I understand where we
are at now.

Barry will propose text that lists out the steps requested in his
original discuss.  I think this could be a helpful addition.  I was
fine with the text of the draft as-is, but see that different people
think differently and this addition could be helpful.  I had to add in
something similar in one of my drafts even though I and a few others
thought the steps were clear, in the end it was helpful to some.

The other item was on LinkedIn and I think we are ok now on the text
change, is that right?  To see if I can help, I do agree with Stephen
here and hope the updated text is enough to move forward on this one
(it seems to be the case).  If the LinkedIn attack is mentioned, most
know that it was a large scale attack against the passwords stored on
the server side.  For what it's worth, just the mention of an attack
is not necessarily bad press.  Most look at how a company handled an
attack and the aftermath now rather than the fact that one happened.
Sometimes it is positive and most of the time it turns out to positive
for companies (even TJ Max had an increase in sales after their breach
that involved compromised Point of Sale systems).

Barry, as an FYI, the focus on passwords is partly due to my review as
that is what this draft is helping to solve.  I wanted text removed
that talked about phishing attacks because they are far more
complicated than just passwords and can involve lots of different
types of credentials.  I do think the focus on passwords is more
appropriate.

Thank you,
Kathleen

On Tue, Jan 6, 2015 at 4:59 AM, Barry Leiba <barryleiba@computer.org> wrote:
>>> A proto -10 version with changes indicated below is at [1] the
>>> diff vs. -09 at [2].
>>
>> Will try to look at that later (Tues evening, China time).
>
> Got a chance to look at the diffs now; yes, it looks good, and thanks again.
>
> Barry
>
> _______________________________________________
> http-auth mailing list
> http-auth@ietf.org
> https://www.ietf.org/mailman/listinfo/http-auth

-- 

Best regards,
Kathleen