Re: Security for various IETF services

[t.p. <[e-mail]>]

----- Original Message -----
From: "Spencer Dawkins" <[e-mail]>
To: "Ted Lemon" <[e-mail]>; "Stephen Farrell"
<[e-mail]>
Sent: Monday, April 07, 2014 3:12 PM
> On 04/07/2014 08:03 AM, Ted Lemon wrote:
> > On Apr 7, 2014, at 7:01 AM, Stephen Farrell
<[e-mail]> wrote:
> >> Yes, we ought move away from passwords if/when we ever find an
> >> acceptably better solution, and yes, people ought manage their
> >> passwords well, but neither are today's reality more's the pity.
> > Perhaps it would be worth setting up support for client certs as a
way to log in to IETF services.   If we won't start, why would someone
else?
>
> (Speaking as 1/15th, but only 1/15th, of the IESG that's asking for
> community input on this topic)
>
> For me, "If we won't start, why would someone else?" was a significant
> consideration. I'm not locked in on any particular path, but I thought
> it was useful to ask about this was that if the IETF can't make an
> improved security environment work, that's not a good sign
> (http://en.wikipedia.org/wiki/Eating_your_own_dog_food).

The path that I have seen several Security ADs steer Working Groups down
is to start with a threat analysis before deciding what counter measures
are appropriate.

Here, we seem to be following a path of 'We have got TLS with server
certs (which is pretty useless against most threats) so we will impose
that on everyone and call it an improved security environment'.

Solution first, requirements ignored.  This is not what I think of as
engineering.

Tom Petch

> We can spin up new working groups to address problems we encounter.
Most
> communities seeking to improve their security environment can't do
that.
>
> So, from my own perspective, on-by-default would be sufficient to find
> out what I'd like to find out ... but I'd love to find out at least
part
> of what we'd like to know, in a post-Snowdon world.
>
> We could find out something, without making Stewart run a
> state-of-the-art secure environment on his IoT device to FTP Internet
> Drafts.
>
> Spencer