Re: [Ietf-http-auth] Request for review and consensus -- draft-hartman-webauth-phishing

[Sam Hartman <[e-mail]>]

>>>>> "SM" == SM  <[e-mail]> writes:

    SM> Hi Sam,
    SM> It may be difficult to gain IETF consensus on such
    SM> requirements if the document does not take into account
    SM> ongoing work such as draft-oiwa-http-mutualauth-03.  

I'm familiar with that work.  I just reviewed that draft again; it
definitely seems like that protocol could be deployed in a manner that
is consistent with these requirements.

    SM> By coming
    SM> up with a set of requirements at this stage, we may be
    SM> constraining "other promising paths".

One of my goals in section 1.1 was to avoid doing that.  Assuming the
IETF had consensus behind the text in section 1.1, how would these
requirements constrain other paths?

(as an aside, I personally believe that these would be great
requirements for draft-oiwa-http-mutualauth-03: they would be easy to meet and I believe would if not already met improve the protocol.)
    SM> whereas the user interface questions are better suited for the
    SM> W3C.  
I do agree that specifics of UI should be handled through the W3C.  I
think that details that affect the security of the protocol, such as
requiring that the UI distinguish (in some manner) password fields
that will be sent over the net using basic from those that will be
sent using some secure protocol are within the IETF's scope.

    SM> Quoting a sentence from Section 3:

    SM>    "We assume that users have limited motivation to combat
    SM> phishing."

Would you be happier with  "We assume that users are interested in combatting phishing, but cannot be expected to learn the details of security protocols, certification practices, and the like."

The goal of the existing sentence is to make it clear that asking
use.users to understand Unicode encoding issues, understand detailed
information about what is validated in a certificate etc, is not
appropriate.