Re: [OAUTH-WG] problem statement

[Peter Saint-Andre <[e-mail]>]

On 9/6/11 6:50 PM, Melinda Shore wrote:
> On 09/06/2011 04:23 PM, Peter Saint-Andre wrote:
>> I just looked at the most recent specifications for TLS (RFC 5246) and
>> secure shell (RFC 4253), which I think we'd all agree are two quite
>> successful security technologies. Neither of those specs says anything
>> about not protecting humans users from malicious clients that perform
>> keylogging to capture security-critical data the user might enter.
> 
> I think there's an argument to be made that the user interface
> is sufficiently different that those might not be a great model.
> But it's also the case that there have been security problems
> with both that may or may not have been avoided in part by
> putting in warnings not to trust every crappy, random CA
> certificate that wafts by, or not to respond "Sure - thanks!"
> to every ssh host key you're offered.

Put me in the "may not have been avoided" camp. We can't legislate
common sense (which, sadly, is all too uncommon).

Look, I spent months working on RFC 6125, which has a title too long to
quote here but basically spends many dozens of pages defining what it
means to check that you're connecting to the right TLS server. That
advice at least is something positive that clients can operationalize.
Documenting a lack of superhero powers seems like a waste of time to me,
but if someone wants to propose a few sentences of text that's up to them.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/