Re: [perpass] Getting started...

[SM <[e-mail]>]

Hi Paul,
At 10:20 17-08-2013, Paul Wouters wrote:
>I think we have learned since, that with things like session resumption,
>we can perhaps get both privacy and speed, although the session
>resumption in itself could also be an information leak.

Maybe the IETF could look at this from a "what have we learned" angle 
since then and how we can privacy together with the features we would 
like to have.  To say it different, if there is a trade-off between 
privacy and something else, do we sacrifice privacy in making that trade-off?

>Indeed. Many years ago when in The Netherlands, lawful interception
>became a reality for ISPs, and a tapping specification (TIIT) came into
>existence, ISPs were forced to install commercial "black boxes" that
>complied to the spec. I tried to get funding to make an open source
>implementation. I quickly found that no one wanted to be known for
>sponsoring an interception device. Everyone agrees an opensource box
>is better than a blackbox, but everyone was afraid of misinterpretation.

It's bad PR and that's the angle people value more.  The benefit of 
having an open source implementation is that anyone who wants to know 
what is being done can read the source code instead of relying on 
rumors which lead to fear and deception.

By the way, you might have tried to implement too early, i.e. people 
may not have understood the value of what you were trying to 
do.  It's also difficult to get funding for anything that isn't 
mainstream if you happen to be in the wrong country.

Regards,
-sm