Re: [TLS] Industry Concerns about TLS 1.3

[Hannes Tschofenig <[e-mail]>]

Hi Ryan,

people working in the security field know what features TLS provides and
those are highly valued since otherwise it wouldn't be used so widely.

I prefer to finalize the work on TLS 1.3 as planned. There are various
groups successfully working on their implementations and I am looking
forward to a well-attended Hackathon at the next IETF meeting.

Ciao
Hannes


On 09/29/2016 09:01 AM, Ryan Carboni wrote:
> I've never quite understood what TLS was supposed to be protecting
> against, and whether or not it has done so successfully, or has the
> potential to do so successfully.
> 
> Well, I don't think anyone here even knows how to protect a mailing list
> from multi-billion dollar threat actors so...???
> 
> Let me quote RFC 3526: 
> "The
>    strengths of the groups defined here are always estimates and there
>    are as many methods to estimate them as there are cryptographers."
> 
> But whatever. You people aren't even willing to do what the Germans
> did... twice.
> 
> Personally I think TLS should be scrapped, replaced with a protocol
> without negotiation, replace PKI with trusted notaries
> ( https://en.wikipedia.org/wiki/Convergence_(SSL) ), etc.
> 
> But, no one has been able to program anything correctly, not even
> certificate authorities: 
> 
> https://www.schrauger.com/the-story-of-how-wosign-gave-me-an-ssl-certificate-for-github-com
> 
> I'm not paying you people anyway. At least the protocol is theoretically
> secure.
> 
> 
> _______________________________________________
> TLS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/tls
>