Re: [Model-t] Fwd: [EXT] New Version Notification for draft-bertola-everything-but-the-user-00.txt

Hi -

My older draft for Model-t takes a stab at giving some examples. It’s not comprehensive yet but goes part of the way:

https://datatracker.ietf.org/doc/draft-lazanski-protocol-sec-design-model-t/

Dominique 

> On 4 Jan 2022, at 20:36, Watson Ladd <watsonbladd@gmail.com> wrote:
> 
> Dear Vittorio,
> 
> I've read the draft. I don't think it provides a useful guide to
> improvements in the threat model. There's too much hypothetical
> language, too little actual examples of privacy being harmed by
> encryption and helped by spying ISPs. I take particular exception to
> two or three sentences from it:
> 
> "It is now expected that a sense of social and corporate
> responsibility, and policy objectives defined outside of the technical
> community, contribute to shaping the choices that will determine the
> future evolution of the Internet."
> 
> Was this ever not true? And who expects it of whom? This has the
> implication that technical expertise means not having the same right
> to have views of social issues and to make decisions on that basis.
> There have been many times: crypto export controls, crypto backdoors,
> .xxx, etc. where activism from the Internet community informed by its
> technical expertise has been vital.
> "
> 
> Under this extended threat model, no claim should be made over the
>   privacy, security or any other property of Internet communications
>   from the end-user's perspective, unless all parties different from
>   the user(s) that take part in the communication, and all their
>   possible motivations, have been considered: hence the "holistic"
>   threat model.
> "
> 
> This is completely unrealistic and means an inordinate amount of work
> for RFC authors. How the heck does TLS even get done with this, given
> the definition of parties includes every software vendor in the world?
> I think there will be problems.
> 
> This document would be a lot stronger if it had cases studies to back
> up its sweeping assertions.
> 
> Sincerely,
> Watson Ladd
> 
> --
> Astra mortemque praestare gradatim
> 
> -- 
> Model-t mailing list
> Model-t@iab.org
> https://www.iab.org/mailman/listinfo/model-t