Re: [TLS] Security concerns around co-locating TLS and non-secure on same port (WGLC: draft-ietf-tsvwg-iana-ports-08)

[Marsh Ray <[e-mail]>]

On 11/11/2010 02:14 PM, Nicolas Williams wrote:
> On Thu, Nov 11, 2010 at 12:17:22PM -0600, Marsh Ray wrote:
>> On 11/11/2010 10:41 AM, t.petch wrote:
>>>
>>> To return to (what I see as) the main purpose of the thread, I too
>>> think that StartTLS is a good, if not an excellent idea; I see no
>>> difference in the vulnerabilities (although my cryptanalysis is weak).
>>
>> Well, that's the thing. In theory there is no difference, in
>> practice however...
>
> FUD alert.

I suppose this conversation isn't going anywhere useful. I'll not burden 
the WG list(s) with it any longer.

Anyone who wants to, feel free to keep up the discussion with 'reply all'.

> You're not explaining why no one uses HTTP StartTLS.

Because my point was that it's not relevant to the discussion. But I 
seemed to have just confused the issue by mentioning it at all.

> Without tracing every program you can't tell if the program is lying to
> you about anything, anything at all.  Your program could be trojaned and
> might be sharing your secret credentials with the bad guys.

Why stop there? There is a whole industry's worth of evidence that even 
professional programmers working in heavily peer-reviewed environments 
can't write substantial programs without backdoors, intentional or not. 
The CPU in your/my computer (or most any of the other chips) has 
undocumented opcodes. The chip designers send their stuff off to someone 
else to be manufactured, too. Still, I need to know if my email program 
is willing to send my password in plaintext.

I claim only that there is a difference between the way my web browser 
handles http/https over TCP ports 80/443, and the way my email program 
handles STARTTLS. It may, in fact, be entirely implementation issues 
that make the difference. But still something could be gained by the 
discussion.

- Marsh