We need to deliver the whole solution

Phillip Hallam-Baker <phill@hallambaker.com> Tue, 22 October 2019 14:30 UTC

Return-Path: <hallam@gmail.com>
X-Original-To: ietf@ietfa.amsl.com
Delivered-To: ietf@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DFAAA120819 for <ietf@ietfa.amsl.com>; Tue, 22 Oct 2019 07:30:53 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.423
X-Spam-Level:
X-Spam-Status: No, score=-1.423 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.226, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.249, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pOoRIr8MXU9Q for <ietf@ietfa.amsl.com>; Tue, 22 Oct 2019 07:30:52 -0700 (PDT)
Received: from mail-oi1-f174.google.com (mail-oi1-f174.google.com [209.85.167.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AEB901201DC for <ietf@ietf.org>; Tue, 22 Oct 2019 07:30:51 -0700 (PDT)
Received: by mail-oi1-f174.google.com with SMTP id i185so14325292oif.9 for <ietf@ietf.org>; Tue, 22 Oct 2019 07:30:51 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=dw2x1BPhx0mQbFZ45CDQfVg0t0gOv5AQSS8qQXi2DJQ=; b=sG80AHg/5BOTVLM2xKffaO/A9LNTZi52V74nCF5veRzrTTvu7xj6lvE/EVYkDn9Ocr ZazrcILvQVSU6JbSBEkeHQY6yA6VsRuOCBzzoVhgnU6D+MwwBvMrj57Mw4ME2HnSimPV fthjhp9oubUzAt6dN5axHhsZ4AgQy3oG9TGglW6uPqI0L0AxP4XfkE2uN1kapbgjS/N/ YHFs1oqJdTMtJooszdVpLUHHwjnbSUlAyWH9Dqus8rjKwuedWMcKljtYTL7XepnIN44f 95gYM9an9sNoVVXlmYJJbXhSPbRSs0xvKyC2wMH0UJoSVJhRvYKyrdP/qPcGHZOGkwhm EPXA==
X-Gm-Message-State: APjAAAUA6KGuqoeSA2UTtq3eaWJcWiBu5USzWoPeAmiZeMNt0ms3H2no TKCxfhXBS8JEz4lWnQGcsejCNaJoTkTOYWoMakByYLD3nLc=
X-Google-Smtp-Source: APXvYqzAZFuDkTZRPk8dPo7QrErbbhrBkQLijQv9JG8HEu6ziNDlrBm088b2TtLxs2i+/uO5IMmGffXsXKRjUhEwPQk=
X-Received: by 2002:aca:7543:: with SMTP id q64mr3273626oic.95.1571754650206; Tue, 22 Oct 2019 07:30:50 -0700 (PDT)
MIME-Version: 1.0
From: Phillip Hallam-Baker <phill@hallambaker.com>
Date: Tue, 22 Oct 2019 10:30:47 -0400
Message-ID: <CAMm+LwgPbTAwOMHXycbAaG7T8piW+sNm7btnaukUMcT4-_dmCg@mail.gmail.com>
Subject: We need to deliver the whole solution
To: IETF Discussion Mailing List <ietf@ietf.org>
Content-Type: multipart/alternative; boundary="000000000000998a62059580a52e"
Archived-At: <https://mailarchive.ietf.org/arch/msg/ietf/KQdreLq4U9TJT6zIyExf9CBnQkY>
X-BeenThere: ietf@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF-Discussion <ietf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ietf>, <mailto:ietf-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ietf/>
List-Post: <mailto:ietf@ietf.org>
List-Help: <mailto:ietf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ietf>, <mailto:ietf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Oct 2019 14:30:54 -0000

This story is happening a lot and not just in the UK. Transit system uses
mobile for payment. Rider's phone dies, is arrested for not having a ticket.

https://metro.co.uk/2019/10/21/boy-handcuffed-police-phone-dies-cant-pay-tube-10956494/?fbclid=IwAR15m1l2V70jKYKxonkpZ05vs8eJcqN5qk-mPF-ozkB4k7E_hXncAApylwk


The problem here is responsibility. Nobody is taking responsibility for the
whole system so responsibility for the system failure lands on the user.

It is never, ever the user's fault.

The phone maker didn't tell the transit system they could use it for this
type of payments scheme (only they did actually). The transit system didn't
think about the consequences of a broken phone.

There is actually a simple fix possible: Put a QR code onto the phone case
that can be scanned even if the phone itself is dead. This can then be used
to provide a 'last resort' ticket if the user opts in to the potential
privacy issues (though anticipating these should mean they can be mitigated
so as to be no worse than for a paper ticket).

QR code binds to DNS name and a symmetric encryption/authentication key.
This provides the necessary bootstrap to obtain needed information.

Alternatively, the user can print out the QR code and put it in their
wallet or print it onto a sticker that can go onto the phone.


Over the past 36 months, there has been a change in the wind. Big tech is
no longer so popular. We are no longer regarded in the same light as ten
years ago. People are starting to see the downside to the brave new world
we have imposed on people. If we are going to keep the support of the
people, we have to acknowledge and fix the problems we are creating.

Twenty odd years ago, an un-named Apple executive had a temper tantrum in a
parking lot after realizing they had forgotten to bring the 240V adapter
they needed for the trip. In an instant, they realized that the adapter
should work in any country. That is the adapter should actually adapt
rather than the human. We need to bring that type of thinking back and
apply it to what we have wrought.

Yes, the technical solution I proposed above is based on a Mathematical
Mesh technology (BOF Friday, Singapore). But the MathMesh is merely a
rebranding of the technologies we should be delivering but for some reason
or other failed to provide. It is there to provide an existence proof that
we can do better.