Re: [Model-t] Review of draft-thomson-tmi

[Mohit Sethi M <[e-mail]>]

Initially, I had a similar opinion: if an endpoint is compromised -> 
game over. You can't do anything about communication security.

But I changed my opinion after reading, understanding, and evaluating 
misbinding attacks: https://dl.acm.org/doi/abs/10.1145/3321705.3329813 
(sorry for self-publicity). Essentially: an honest endpoint can prevent 
a compromised endpoint from involving another honest endpoint into the 
conversation to play confusing games on who is talking to whom. 
Protocols can build mitigations to prevent such games if an endpoint in 
a conversation is compromised.

The same applies to Jari and Matrin's draft. If you tell less about 
yourself to the other endpoint, there is less information available to 
the attacker when the endpoint is eventually compromised.

I think the goal of model-t is not to improve endpoint security. Its 
what bad things can a communication protocol prevent when an endpoint is 
compromised?

--Mohit

On 12/8/21 3:05 PM, Watson Ladd wrote:
> On Wed, Dec 8, 2021 at 2:14 AM Vittorio Bertola
> <vittorio.bertola=[e-mail]> wrote:
>> This is also why I would prefer to make recommendations on intermediaries only after having fully clarified the definitions above. There are cases in which intermediation is the only resort for a user to protect their privacy and security from misbehaving endpoints (e.g. a firewall or filter blocking IoT objects on the local network from connecting to undesired destinations, or preventing the unsuspecting user's browser to connect to a phishing page). We should first understand how the relationship between protocol intermediaries and endpoint intermediaries plays out in terms of user-centred objectives, and only then make recommendations.
> I don't understand how the Internet Engineering Task Force can
> meaningfully address endpoint security. Nor have I seen an example of
> how 3552 updates would meaningfully address this, or changes in
> protocols that would help either. If the product you want is Ware
> report 2.0, that's potentially valuable, but not I think what we need
> for the I part of the IETF.
>