Re: [TLS] Confirmation of Consensus on Removing Compression from TLS 1.3

[[e-mail] (Martin Rex)]

Eric Rescorla wrote:
> 
> This is more an http issue than a tls issue but we pretty much have
> to go with the Web we have which includes (restricted) cross origin
> requests subject to the same origin policy.

Eric, in principle I'm with you.  The TLS WG needs to take into account
real world usage scenarios or it will cease to be a useful technology.

But we are having a real problem that folks a looking at TLS to be
"magic pixie dust", and the perception that any apps or protocol design,
no matter what design flaws it has, will automatically become secure
by adding TLS to it.


I don't see a solution for the disclosing authentication (=passwords)
at the human<->machine interface, not even on the horizon.


But the disclosing authentication on pure machine<->machine interfaces
(including "SSL Cookies") provides ample opportunity for new security
problems, and I'm seeing that TLS channel encryption is (ab)used to
excuse the continued use of disclosing authentication on what is
pure machine<->machine interfaces, and that train is heading in
the wrong direction.


-Martin