Re: [TLS] Should TLS 1.3 use an augmented PAKE by default?

[Paul Hoffman <[e-mail]>]

On Mar 20, 2014, at 8:52 AM, Daniel Kahn Gillmor <[e-mail]> wrote:
> This is the core of the issue for client authentication in a web
> browser, i think.  Regardless of whether we're talking about PAKE or
> client certs or some other mechanism, we have two choices:
> 
> Either:
> 
> A) We begin to establish a new norm for client-authentication UX that
> relies on unspoofable and easily-recognizable browser chrome (with some
> sort of browser-chrome logout mechanism as well), and start training
> users to distrust <input type="password"/> (perhaps at first on a
> site-by-site basis), taking some serious UX control away from web site
> designers.
> 
> or:
> 
> B) We continue to let web sites drive the full UX decisions, and leave
> users vulnerable to phishing attacks.

As an important note, you did not define "we" above. A few possible expansions would be:

- The TLS WG, where this thread currently lives, does not get to define Web UI without a charter change.

- The HTTPbis WG has not asked the TLS WG to take over this work, nor has it embraced anything like it.

- The IETF doesn't do this kind of work as a whole body.

- The IAB (of which none of us are part of the "we") might take the topic on and suggest ways which the IETF might do the work.

> option (A) is seriously hard, maybe impossible given the state of the
> web.  option (B) is terrible.

Exactly right, for any value of "we".

--Paul Hoffman