[TLS] Re: Transparent TLS Client Auth (t2CA)

[Phillip Hallam-Baker <[e-mail]>]

On Thu, May 22, 2025 at 4:07 PM Eric Rescorla <[e-mail]> wrote:

>
>
> On Thu, May 22, 2025 at 12:58 PM Phillip Hallam-Baker <
> [e-mail]> wrote:
>
>> On Thu, May 22, 2025 at 1:58 PM Eric Rescorla <[e-mail]> wrote:
>>
>> * Allowing the site to control the timing of the authentication
>>>>>   (e.g., offering you connect unauthenticated and then upgrading).
>>>>> * Allowing the site to offer multiple authentication options.
>>>>> * Allowing the site to control the look and feel of the interaction.
>>>>>
>>>>
>>>> I don't want the site to be doing any of that. I want there to be a
>>>> single consistent authentication experience across everything. Without
>>>> consistency, users have no idea what they are doing and the scheme is
>>>> vulnerable to social engineering attacks.
>>>>
>>>
>>>>> What matters here is not what you want but rather what the site wants,
>>>>> and in my experience they want these properties.
>>>>> So, again, I ask: which major players in the current ecosystem are
>>>>> interested in this.
>>>>>
>>>>
>> I missed this the first time. Are you serious?
>>
>> 'What matters here is not what you want but rather what the site wants'
>>
>> So, we only listen to the businesses and corporations, not the Web users?
>>
>
> No. I think we should design technologies that benefit users, but we
> should spend our
> time designing technologies that will actually get deployed. And that
> means understanding
> whether there is demand for these technologies by the people in charge of
> deploying
> them. That doesn't of course mean that every feature of those technologies
> needs
> to be to the liking of those players, and often it will not be, but if
> there is no interest
> in the big picture, then I don't think standardization work is useful.
>

Of all the folk working in IETF, I suspect I spend the most time developing
deployment plans. I don't always succeed but I have a pretty good batting
average.

But working out deployment always comes after working out what the user
needs and what the technical constraints are. What are the pain points
driving the key stakeholders?

I rather suspect a lot of European Web sites would go for any technology
that allows them to drop the 'accept all cookies' banners...


I think you are dead wrong about what the sites want. I have heard many,
>> many sites say they want OpenID without having Facebook or Google in the
>> loop. They absolutely do not want an auth system that has their biggest
>> competitive threats seeing who visits them.
>>
>
> In that case there will be interest and this might be worth doing.
>
> -Ekr
>
>