From: "Stewart Bryant (stbryant)" <stbryant@cisco.com>
To: Stephen Farrell <stephen.farrell@cs.tcd.ie>
Subject: Re: Security for various IETF services
Thread-Topic: Security for various IETF services
Thread-Index: AQHPUC2GODnIxqXM80KR8vvcGbq07psCt8zG
Date: Sat, 5 Apr 2014 08:50:21 +0000
Message-ID: <27993A73-491B-4590-9F37-0C0D369B4C6F@cisco.com>
References: <533D8A90.60309@cs.tcd.ie>,<533EEF35.7070901@isdg.net>
In-Reply-To: <533EEF35.7070901@isdg.net>
Accept-Language: en-GB, en-US
Content-Language: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: http://mailarchive.ietf.org/arch/msg/ietf/2lglnoiOcqv1gImSRQdHBJehcyk
Cc: IETF-Discussion <ietf@ietf.org>, The IESG <iesg@ietf.org>
Precedence: list

>>=20
>> "The IETF are committed to providing secure and privacy
>> friendly access to information via the web, mail, jabber
>> and other services.

Please confirm that "friendly" implies that the user gets to
choose the degree of security privacy that they consider=20
appropriate, and that their applications and devices are not=20
encumbered  with the overheads unless they choose to invoke
the privacy and security mechanisms.
=20

>> While most (but not all) data on IETF
>> services is public, nonetheless access to that data
>> should use best practices for security and privacy.

I agree, but please can you clarify your interpretation
of "best practise" so that we can understand how
liberal or prescriptive this is?

>> However, as there are numerous legacy tools that have been
>> built that require access via cleartext, the IETF will
>> continue to allow such access so as not to break such
>> tooling. New services will however generally only be made
>> available in ways that use security protocols such as
>> TLS."
>>=20

That is worrying, because it seems that you are intent on
encumbering transactions, without requiring a case by=20
case study of the threat model, and applying a security
and privacy model that is appropriate to the specific=20
transaction.

Stewart.