Re: [kitten] [EXTERNAL] Re: Windows Intent to revive and implement IAKerb draft-ietf-kitten-iakerb-03

[Ken Hornstein <[e-mail]>]

>Just throwing it out here, because I sure would love to make it
>possible (and easier) to use kerberos-backed out on the Web, without
>all the issues that come with multiple-roundtrips, which are what I
>find breaks most of these scenarios (the complexity of the protocol
>itself and the unfamiliarity of any non-password/bearer based auth
>scheme aside).

You know, the frustrating thing to me (as a Kerberos fan) is that
the multiple roundtrips problem isn't a Kerberos problem but more
related to all of the stuff layered on top of Kerberos (GSS, SPNEGO,
etc etc).  I see how we got here, but I always was a bit skeptical of
the value-add of all of those layers in practice.

As an aside ... it seems to me that the a constant of history is that it
is impossible to predict how protocols will evolve (another constant:
the most commonly implemented security protocol will be the least common
denominator).  Maybe eventually we'll all be dismissing Java Web Tokens
and REST APIs as "legacy protocols".  I'm not arguing against something
that works in the modern world, just commenting that it's impossible to
know how things will evolve.

--Ken