Re: [http-auth] Barry Leiba's Discuss on draft-ietf-httpauth-hoba-09: (with DISCUSS and COMMENT)

[Michael Thomas <[e-mail]>]

On 01/06/2015 12:20 AM, Barry Leiba wrote:
>
> Yet here we still are? :-)
> Because I think the discussion needs to continue.  I still don't
> understand why you think it's so important to single out LinkedIn,
> such that it's worth the damage that having that in an RFC represents.
>
>>> The fact that there's a plethora of examples really speaks to not
>>> calling out one company on this,
>> I re-iterate: At the time of writing this was the poster-child
>> example. It still remains one, and a good one for RFC readers.
> It was not "the poster child": there have been so many of these
> breaches, both before and since, that I see no reason at all to call
> out any one instance.


I'm pretty sure that I'm responsible for the offending text and it was 
enough of a a poster child
in my mind because my JS implementation was a direct response in an 
"enough is enough" way. Yes,
there have been lots of these but if a large, well known, well funded 
company is vulnerable, how
can we expect everybody else to not fall prey? The problem isn't with 
LinkedIn per se -- and it makes
me extremely angry when the finger waggers inevitably blame end users -- 
it's with password schemes
in general, which is a failure of engineering.

FWIW, I don't see LinkedIn in this case as "name and shame" but more of 
"this too can be YOU"
example. For that reason, I think it's better to leave it in as a 
cautionary tale instead of diluting it
down to non-specific "others".

Mike