IETF Logo Mail Archive

Re: [therightkey] Basically, it's about keeping the CAs honest

David Conrad <drc@virtualized.org> Mon, 13 February 2012 19:03 UTC

Return-Path: <drc@virtualized.org>
X-Original-To: therightkey@ietfa.amsl.com
Delivered-To: therightkey@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 51C9521F8697 for <therightkey@ietfa.amsl.com>; Mon, 13 Feb 2012 11:03:04 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3Pvu3qcM23eO for <therightkey@ietfa.amsl.com>; Mon, 13 Feb 2012 11:03:03 -0800 (PST)
Received: from trantor.virtualized.org (trantor.virtualized.org [199.48.134.42]) by ietfa.amsl.com (Postfix) with ESMTP id BF51821F8687 for <therightkey@ietf.org>; Mon, 13 Feb 2012 11:03:03 -0800 (PST)
Received: from [192.168.2.159] (unknown [173.245.57.22]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: drc) by trantor.virtualized.org (Postfix) with ESMTPSA id 457B21705A; Mon, 13 Feb 2012 19:03:03 +0000 (UTC)
Mime-Version: 1.0 (Apple Message framework v1257)
Content-Type: text/plain; charset="us-ascii"
From: David Conrad <drc@virtualized.org>
In-Reply-To: <CAK3OfOg7H5y614DQeDDnznxxAbopXiTbuy4UjPprrigSw+D_DA@mail.gmail.com>
Date: Mon, 13 Feb 2012 11:03:01 -0800
Content-Transfer-Encoding: quoted-printable
Message-Id: <C816C168-0CFC-4A8F-A3AA-0A68F1971978@virtualized.org>
References: <201202131636.q1DGafVR006049@fs4113.wdf.sap.corp> <0600CF7A-A8CB-4E35-B729-43D626434645@virtualized.org> <CAMm+LwjkPZm9FF=FGx+vb_JxLRbygm-y1H85Powq6U0UfxSKCQ@mail.gmail.com> <CAK3OfOg7H5y614DQeDDnznxxAbopXiTbuy4UjPprrigSw+D_DA@mail.gmail.com>
To: Nico Williams <nico@cryptonector.com>
X-Mailer: Apple Mail (2.1257)
Cc: therightkey@ietf.org
Subject: Re: [therightkey] Basically, it's about keeping the CAs honest
X-BeenThere: therightkey@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: <therightkey.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/therightkey>, <mailto:therightkey-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/therightkey>
List-Post: <mailto:therightkey@ietf.org>
List-Help: <mailto:therightkey-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/therightkey>, <mailto:therightkey-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 13 Feb 2012 19:03:04 -0000

On Feb 13, 2012, at 10:42 AM, Nico Williams wrote:
> Not all spy-on-your-employees solutions are bad, thus the fact that
> alternatives will arise does not necessarily bother me.

And they aren't all 'spy-on-your-employees'.  For example, companies such as CloudFlare (for whom I work), Incapsula, Torbit, etc., provide various web security and performance-related services by acting as a reverse proxy and scrubbing HTTP/HTTPS connections.  These services tend to be targeted at SMEs who are often less-than-technically-knowledable web site operators and those website owners will reject any solution that isn't transparent to their customers. While I can't speak for the others, CloudFlare's service is not in any way a "spy-on-your-employees" solution, rather it is a service in which website owners intentionally insert a MITM that helps them deal with various attacks (DDoS, blog spam, screen scrapers, etc).

Regards,
-drc

v2.23.0 | Report a Bug | By Email