Re: [saag] Additions to RFC 3631?

[Nico Williams <[e-mail]>]

On Mon, May 21, 2012 at 1:23 PM, Yaron Sheffer <[e-mail]> wrote:
> Trying my best to be unpopular:
>
> Much as I like the concept of BTNS, it hasn't caught on. I see this RFC as
> providing useful guidance to practitioners, and non-existent technology
> doesn't cut it.

Hey, I said it too.

> On the other hand, SSH "leap of faith" is very close to BTNS, and should in
> fact be mentioned in the paragraph that discusses SSH. In the context of
> SSH, "leap of faith" is much more innovative than what the current text
> focuses on.

Right.  But note that for me BTNS was not about leap-of-faith, though
that was a key selling point for some.  For me BTNS was about
anon-anon channels that could be bound into app-layer authentication.

> Email security takes up a significant part of the document (Sec. 3.10). We
> might wish otherwise (I do), but none of these mechanisms has been a
> real-world success. And very few people write new Email software anyway. So
> I would eliminate this section altogether or fold it into a paragraph or two
> in "Security/Multipart".

I assume e-mail is not secure.  Secure e-mail that doesn't scale well
is easy enough to do (PGP, S/MIME), but it has lots of issues beyond
scalability.  If you want secure e-mail use IM w/ OTR.  (Hmmm,
shouldn't OTR be an Internet protocol?)

Nico
--