Re: Security for various IETF services

[Spencer Dawkins <[e-mail]>]

On 04/07/2014 08:03 AM, Ted Lemon wrote:
> On Apr 7, 2014, at 7:01 AM, Stephen Farrell <[e-mail]> wrote:
>> Yes, we ought move away from passwords if/when we ever find an
>> acceptably better solution, and yes, people ought manage their
>> passwords well, but neither are today's reality more's the pity.
> Perhaps it would be worth setting up support for client certs as a way to log in to IETF services.   If we won't start, why would someone else?

(Speaking as 1/15th, but only 1/15th, of the IESG that's asking for 
community input on this topic)

For me, "If we won't start, why would someone else?" was a significant 
consideration. I'm not locked in on any particular path, but I thought 
it was useful to ask about this was that if the IETF can't make an 
improved security environment work, that's not a good sign 
(http://en.wikipedia.org/wiki/Eating_your_own_dog_food).

We can spin up new working groups to address problems we encounter. Most 
communities seeking to improve their security environment can't do that.

So, from my own perspective, on-by-default would be sufficient to find 
out what I'd like to find out ... but I'd love to find out at least part 
of what we'd like to know, in a post-Snowdon world.

We could find out something, without making Stewart run a 
state-of-the-art secure environment on his IoT device to FTP Internet 
Drafts.

Spencer