Re: [TLS] TLSrenego - current summary of semantics and possibilities

[Nicolas Williams <[e-mail]>]

On Tue, Nov 10, 2009 at 03:17:28PM -0600, Marsh Ray wrote:
> It's one thing to say, realistically, some client applications may elect
> to put their users at risk for the sake of continuing to work with
> defective servers.
> 
> It's something else entirely to propose that an IETF spec's official
> language and recommended practice for implementors should be weakened in
> consideration for these noncompliant systems.

Indeed.  And I don't propose the latter.  Instead, if we must say the
sky will now be <color other than blue> we should also caveat that it
will likely continue to be blue for a long time.

> Perhaps those responsible for such systems will take this opportunity to
> update them?

One should hope so.

> Yair Elharrar wrote:
> > This could backfire. It would allow hackers to detect unpatched
> > clients, and focus their attacks on them.
> 
> There are plenty of ways for to attackers to fingerprint clients (looked
> at a user-agent string lately?) and it doesn't make sense to make life
> difficult for those who have a legitimate need for the data.

Agreed.  Also, looking vulnerable and being vulnerable are not the same
thing.