Re: [TLS] Should TLS 1.3 use an augmented PAKE by default?

[Yaron Sheffer <[e-mail]>]

>
> Even for IMAP, using PAKE, augmented or balanced, would give a
> significant amount of protection against MITMs who have compromised a
> CA.  Since compromising a CA seems to be a popular thing to do these
> days, resisting these attacks at the protocol level would add
> considerable value.
>
> --Andy
>

IMAP/SMTP is a great example where PAKE could add significant security: 
CA compromise is arguably rare, but coffee-shop captive portals that 
hijack IMAP/SMTP and present their own certificate are quite common. The 
user gets a message from their mail client asking if they will accept 
this certificate, and you can guess what they'll choose... Next thing 
you know, the password is sent in the clear to the server.

Thanks,
	Yaron