Re: [saag] Ubiquitous Encryption: spam filtering

[Phillip Hallam-Baker <[e-mail]>]

On Tue, Jun 30, 2015 at 4:04 PM, John R Levine <[e-mail]> wrote:

> The first last and only reason phishing is possible is that we use
>> authentication credentials that we expect people to keep in their head,
>> never write down and only ever give them to people who are trustworthy.
>>
>
> That's some of it, but I've seen malware that does MITM attacks to
> redirect transactions authenticated with uncompromised two-factor devices.
> If all of the pieces are used exactly correctly, you're pretty secure, but
> we know how likely that is in the long term.
>
> Like I said about spam, it's a hard problem.  In spam, exempting people
> you know from spam filtering doesn't work.  Partly that's because the
> introduction problem is as hard as the spam problem, partly that's because
> it'll just push spammers toward using compromised legit accounts, something
> they do a lot of already.


I have no idea why we are still stuck with that junk. Yes, they have the
same problems as passwords. But these days the programs run on mobile
supercomputers with communications and touch screen displays known as
'smartphones'.

Bank sends a request to the phone/watch saying 'do you want to transfer
$10,000'

Phone/watch authenticates request, gets user input, signs request, returns
response to bank.

The keys used for signing need never leave the device.


OK I know exactly why we are stuck with the junk. Hence my proposal for the
mesh.