Re: [Model-t] w3c also thinking about threat models

[Stephen Farrell <[e-mail]>]

Bret,

On 23/09/2019 15:41, Bret Jordan wrote:

> Given how nearly all attacks, campaigns, malware, and intrusion sets
> use the web or software connecting to the web 

Malware (ab)using the web doesn't imply anything about
what might be right or wrong with the current web security
model though. Same as malware doing that doesn't imply
anything about the security model for IP, which is also
in use in almost all such cases.

I think that's an error that keeps cropping up in these
discussions that we might wanna try figure out some, i.e.,
(and generalising) if protocol-X can be abused for bad-thing-Y
in a way that's (from some vantage point) indistinguishable
from nominal use of protocol-X, then what does that say about
the threat model used to develop protocol-X? It might be
evidence that a better threat model would have resulted
in a better protocol-X, or, it might be due to a problem
with that vantage point (no longer) being a good place to
distinguish nominal behaviour vs. bad-thing-Y, for protocol-X.

In the case of the web, I think a lot of the issues raised
by folks like yourself seem to come down to the shift from
a cleartext to a ciphertext web changing the set of vantage
points from which one can (trivially) attempt to make such
distinctions.

That doesn't imply that the web security model is broken
though, given the set of trade-offs that have to be dealt
with. (And also given the set of IETF consensus positions
about e2e and not breaking crypto etc. that are relevant to
this discussion, if we want a successful outcome to bring
back into IETF-land.) Nor does that change mean that the set
of problems faced by enterprise networks are to be ignored,
but ISTM the current web security model and the practicalities
of changing that do constrain how one might sensibly go about
trying to improve the situation for users and operators of
such networks. (And I agree improvements are needed or I'd
not be interested in this discussion:-)

> to either compromise
> victims, 

Where web vulns are used as part of a compromise, then
yes, those indicate problems with the web security model.
Meaning the likes of XSS happens too easily etc. I guess
ideas to try improve those might mostly be better handled
in the W3C though, but discussing 'em here seems reasonable
as long as we keep that in mind.

> exfiltrate personal or private information from victims, or
> destroy victims’ information I think one could easily argue that your
> statement that there is "a reasonably worked out security model" is
> false.

Except that wasn't my statement, that's just a misquote.
What I said was "...a reasonably worked out, (even if
imperfect) security model (the SOP etc)..." after which
I bemoaned the privacy impacts of the current web;-)

Cheers,
S.

> 
> 
> 
> Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8
> ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however,
> the only thing that can not be unscrambled is an egg."
> 
>> On Sep 20, 2019, at 2:01 PM, Stephen Farrell
>> <[e-mail]> wrote:
>> 
>> On 20/09/2019 18:48, Bret Jordan wrote:
>>> Yes, privacy is just one facet.
>> 
>> Sure, it's clearly true that privacy is not everything in the IETF
>> context, nor in w3c either. I guess the argument for putting more
>> focus on privacy in w3c might be that the web has a reasonably
>> worked out, (even if imperfect) security model (the SOP etc), but
>> that the web has been pretty awful for privacy. Well, that's an 
>> argument I'd make, not sure if the people involved in the w3c work
>> would:-)
>> 
>> S.
>> 
>>> 
>>> 
>>> Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8
>>> ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw,
>>> however, the only thing that can not be unscrambled is an egg."
>>> 
>>>> On Sep 20, 2019, at 11:12 AM, Dominique Lazanski
>>>> <[e-mail]> wrote:
>>>> 
>>>> 
>>>> 
>>>>> On 20 Sep 2019, at 11:26, Stephen Farrell
>>>>> <[e-mail]> wrote:
>>>>> 
>>>>> 
>>>>> Hiya,
>>>>> 
>>>>> Hope we all had a nice summer break from this discussion, but
>>>>> I'd like to try see if we can get back at it, so I've added
>>>>> reviewing the various drafts folks have posted to my todo 
>>>>> list - I hope to send some comments/reviews in the next
>>>>> week-ish.
>>>>> 
>>>>> In the meantime, it looks like w3c are also thinking about
>>>>> threat models [1] which is interesting.
>>>>> 
>>>>> Cheers, S.
>>>> 
>>>> Thanks for kick starting this list again especially after the
>>>> summer!
>>>> 
>>>> Interesting W3C work, but I would add that they are only
>>>> looking at privacy threat models so they have that covered.
>>>> Perhaps we should look at system security threat models since
>>>> W3C has kicked off their work specifically on privacy. That way
>>>> we can be more holistic about the work.
>>>> 
>>>> Looking forward to the discussions.
>>>> 
>>>> Dominique
>>>> 
>>>> -- Model-t mailing list [e-mail] 
>>>> https://www.iab.org/mailman/listinfo/model-t
>>> 
>>> 
>>> 
>> <0x5AB2FAF17B172BEA.asc>
> 
> 
>