Re: [Model-t] w3c also thinking about threat models

[Dominique Lazanski <[e-mail]>]

> On 23 Sep 2019, at 16:32, Stephen Farrell <[e-mail]> wrote:
> 
> 
> Bret,
> 
> On 23/09/2019 15:41, Bret Jordan wrote:
> 
>> Given how nearly all attacks, campaigns, malware, and intrusion sets
>> use the web or software connecting to the web 
> 
> Malware (ab)using the web doesn't imply anything about
> what might be right or wrong with the current web security
> model though. Same as malware doing that doesn't imply
> anything about the security model for IP, which is also
> in use in almost all such cases.
> 
> I think that's an error that keeps cropping up in these
> discussions that we might wanna try figure out some, i.e.,
> (and generalising) if protocol-X can be abused for bad-thing-Y
> in a way that's (from some vantage point) indistinguishable
> from nominal use of protocol-X, then what does that say about
> the threat model used to develop protocol-X? It might be
> evidence that a better threat model would have resulted
> in a better protocol-X, or, it might be due to a problem
> with that vantage point (no longer) being a good place to
> distinguish nominal behaviour vs. bad-thing-Y, for protocol-X.
> 
> In the case of the web, I think a lot of the issues raised
> by folks like yourself seem to come down to the shift from
> a cleartext to a ciphertext web changing the set of vantage
> points from which one can (trivially) attempt to make such
> distinctions.
> 
> That doesn't imply that the web security model is broken
> though, given the set of trade-offs that have to be dealt
> with. (And also given the set of IETF consensus positions
> about e2e and not breaking crypto etc. that are relevant to
> this discussion, if we want a successful outcome to bring
> back into IETF-land.) Nor does that change mean that the set
> of problems faced by enterprise networks are to be ignored,
> but ISTM the current web security model and the practicalities
> of changing that do constrain how one might sensibly go about
> trying to improve the situation for users and operators of
> such networks. (And I agree improvements are needed or I'd
> not be interested in this discussion:-)

FWIW it would be useful to be all inclusive with ideas and threats and then define what is in and out of scope for the threat model rather than limit the scope right away. 

> 
>> to either compromise
>> victims, 
> 
> Where web vulns are used as part of a compromise, then
> yes, those indicate problems with the web security model.
> Meaning the likes of XSS happens too easily etc. I guess
> ideas to try improve those might mostly be better handled
> in the W3C though, but discussing 'em here seems reasonable
> as long as we keep that in mind.
> 
>> exfiltrate personal or private information from victims, or
>> destroy victims’ information I think one could easily argue that your
>> statement that there is "a reasonably worked out security model" is
>> false.
> 
> Except that wasn't my statement, that's just a misquote.
> What I said was "...a reasonably worked out, (even if
> imperfect) security model (the SOP etc)..." after which
> I bemoaned the privacy impacts of the current web;-)
> 
> Cheers,
> S.
> 
>> 
>> 
>> 
>> Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8
>> ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however,
>> the only thing that can not be unscrambled is an egg."
>> 
>>> On Sep 20, 2019, at 2:01 PM, Stephen Farrell
>>> <[e-mail]> wrote:
>>> 
>>> On 20/09/2019 18:48, Bret Jordan wrote:
>>>> Yes, privacy is just one facet.
>>> 
>>> Sure, it's clearly true that privacy is not everything in the IETF
>>> context, nor in w3c either. I guess the argument for putting more
>>> focus on privacy in w3c might be that the web has a reasonably
>>> worked out, (even if imperfect) security model (the SOP etc), but
>>> that the web has been pretty awful for privacy. Well, that's an 
>>> argument I'd make, not sure if the people involved in the w3c work
>>> would:-)
>>> 
>>> S.
>>> 
>>>> 
>>>> 
>>>> Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8
>>>> ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw,
>>>> however, the only thing that can not be unscrambled is an egg."
>>>> 
>>>>> On Sep 20, 2019, at 11:12 AM, Dominique Lazanski
>>>>> <[e-mail]> wrote:
>>>>> 
>>>>> 
>>>>> 
>>>>>> On 20 Sep 2019, at 11:26, Stephen Farrell
>>>>>> <[e-mail]> wrote:
>>>>>> 
>>>>>> 
>>>>>> Hiya,
>>>>>> 
>>>>>> Hope we all had a nice summer break from this discussion, but
>>>>>> I'd like to try see if we can get back at it, so I've added
>>>>>> reviewing the various drafts folks have posted to my todo 
>>>>>> list - I hope to send some comments/reviews in the next
>>>>>> week-ish.
>>>>>> 
>>>>>> In the meantime, it looks like w3c are also thinking about
>>>>>> threat models [1] which is interesting.
>>>>>> 
>>>>>> Cheers, S.
>>>>> 
>>>>> Thanks for kick starting this list again especially after the
>>>>> summer!
>>>>> 
>>>>> Interesting W3C work, but I would add that they are only
>>>>> looking at privacy threat models so they have that covered.
>>>>> Perhaps we should look at system security threat models since
>>>>> W3C has kicked off their work specifically on privacy. That way
>>>>> we can be more holistic about the work.
>>>>> 
>>>>> Looking forward to the discussions.
>>>>> 
>>>>> Dominique
>>>>> 
>>>>> -- Model-t mailing list [e-mail] 
>>>>> https://www.iab.org/mailman/listinfo/model-t
>>>> 
>>>> 
>>>> 
>>> <0x5AB2FAF17B172BEA.asc>
>> 
>> 
>> 
> <0x5AB2FAF17B172BEA.asc>