Re: [http-auth] Alissa Cooper's No Objection on draft-ietf-httpauth-hoba-09: (with COMMENT)

["Martin J. Dürst" <[e-mail]>]

On 2015/01/08 10:13, Spencer Dawkins at IETF wrote:
> On Jan 8, 2015 8:58 AM, "Kathleen Moriarty" <
> [e-mail]> wrote:

>> On Jan 7, 2015, at 7:39 PM, Spencer Dawkins at IETF <
> [e-mail]> wrote:

>>> I'm no security maven, but when I was reading recently about Sony's
> wizard security practices, I thought to myself, "I'd never do anything that
> dumb", and kind of stopped there. I wonder if that's more likely if the
> text calls out any single company.
>>>
>>> Spencer, who may still be too nice to be an AD ...
>>
>>
>> For big attacks, the security folks tend to name the first or a big
> recent example of a specific attack.  When you say the LinkedIn attack, I
> remember that there was some crazy large (I think a million+) number of
> passwords stolen from at he server side.  This caused a lot of questions
> from friends and lots of password changes (well publicized).  In response
> to Barry's question on this that led to Stephen's update, I mentioned that
> most look at how a company responds in terms of reputation as opposed to
> the fact that an event occurs.  Business usually goes up as crazy as that
> sounds.  RSA gets mentioned when the discussion is about APTs or the trend
> in supply chain attacks. I hope this was helpful.
>
> This all makes sense to me.
>
>> Does the new language help enough?  I think it does, but  another
> security person.
>
> I think the question is whether we think the readers of this RFC (to be)
> will have the security community mindset, or whether there will be a
> broader audience.
>
> I have no idea which of those is the case, of course.

What about *both*?   Regards,   Martin.