Re: Hum theatre

Phillip Hallam-Baker <> Thu, 07 November 2013 17:48 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 9CE4E11E81E6 for <>; Thu, 7 Nov 2013 09:48:54 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.494
X-Spam-Status: No, score=-2.494 tagged_above=-999 required=5 tests=[AWL=0.105, BAYES_00=-2.599, HTML_MESSAGE=0.001, NO_RELAYS=-0.001]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id o-T4Og8LS+SU for <>; Thu, 7 Nov 2013 09:48:53 -0800 (PST)
Received: from ( [IPv6:2a00:1450:4010:c03::235]) by (Postfix) with ESMTP id D465411E818D for <>; Thu, 7 Nov 2013 09:48:34 -0800 (PST)
Received: by with SMTP id eh20so714234lab.26 for <>; Thu, 07 Nov 2013 09:48:33 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=dOCDgKbEGM99a9x/xHyr62vg684VsryIM9IvPvlWqnM=; b=dWYridWaaAfBtyxaBPBSPSNPtB3m4/woyU6ixJQCKsZc0FE7fCI3BnMi79cNGdkPFi xkf0PHRFSeS6Xykj8iDs4/aSzJ668zCleK4AoOYQOEkvWuMLv/gzwPhV0WCG2s3VQudz j5xRgrZjit++v+VRDxC6SA5Lq1znfeB2tCClE4vsLffngsDv37uVM8o/qwzT6l+ZWyS2 oldJgVsY6UEdSpL2fXfJHTlY8gUE1GCjanq2yvewniPf0v/LCX9Tme1MqwL4CvstSLeh PqhBr+KJM13+juTIph05XMh0uPuFLYizsnD4Le0E4R6RXAbcbNIkuMWobz18yYJLmFNB xE4Q==
MIME-Version: 1.0
X-Received: by with SMTP id xh10mr1100241lac.15.1383846513816; Thu, 07 Nov 2013 09:48:33 -0800 (PST)
Received: by with HTTP; Thu, 7 Nov 2013 09:48:33 -0800 (PST)
In-Reply-To: <>
References: <> <> <> <> <> <>
Date: Thu, 7 Nov 2013 12:48:33 -0500
Message-ID: <>
Subject: Re: Hum theatre
From: Phillip Hallam-Baker <>
To: Carsten Bormann <>
Content-Type: multipart/alternative; boundary=001a1134b65ee1395904ea99df4b
Cc: "Klaas Wierenga \(kwiereng\)" <>, IETF Discussion <>
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: IETF-Discussion <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 07 Nov 2013 17:48:54 -0000

The sentiment is unanimous

Opinion on how to act on that sentiment remains divided.

One of the reasons that opinion on how to act is divided is that the
discussion of TLS everywhere is focused on the value TLS is designed to
bring to secure Internet protocols rather than the total value proposition
of TLS which was always intended to be wider.

The point of VeriSign Class 3 and later Organization Validation criteria
and the Extended Validation criteria is to establish ACCOUNTABILITY. The
authentication is a means to that end and the encryption is a nice

People have been using TLS with no accountability but authentication. Which
was only bad because the browsers didn't differentiate between the two
until Extended Validation was deployed.

Using crypto is not a problem, telling people that they are safe when they
are not is the problem. At the moment the IETF does not use metrics to
determine how difficult it would be for an attacker to break a system. This
is my effort in the area: