Re: [saag] Fw:Fw:New Version Notification for draft-cui-dhc-dhcpv6-encryption-02.txt

[ianG <[e-mail]>]

On 29/07/2015 12:40 pm, Randy Bush wrote:
> TOFU is a bit oxymoronic, or certainly abuses 'trust'.  it is more like
> You Undergo Big Attack.  it just gives you some assurance the attacker
> is reproducible.
>
> but this is a tangent.  the point is that protocols which rely on
> keying really need to nail the key distribution model(s).
>
> while tofu may be one, is it really one that security folk think the
> ietf should advocate for set-up authenticity?


Hell yeah!  It's worked to deliver pretty much 100% security &/= 
availability for the worlds that use it.

The balance we want is TOFU every time all time with option of upgrading 
to something stronger if user cares.


> it's not how i want to
> make the wsj; and coffee shop mitm will be in the wsj soon enough.


Oddly - coffee shops & pubs in UK have been MITM routinely for at least 
a couple of years that I've noticed.  Shocking really, but nobody seems 
to care.  The trick is to find a coffee house that has its own WIFI - 
and gives you a password.  The ones with franchise WIFIs are all doing 
MITMs as far as I can see.



iang