[Uta] A quote from the cryptography list on security in practice.

Viktor Dukhovni <ietf-dane@dukhovni.org> Fri, 22 March 2019 05:28 UTC

Return-Path: <ietf-dane@dukhovni.org>
X-Original-To: uta@ietfa.amsl.com
Delivered-To: uta@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3A4AD13160A for <uta@ietfa.amsl.com>; Thu, 21 Mar 2019 22:28:32 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.201
X-Spam-Level:
X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ao525x3N2FaY for <uta@ietfa.amsl.com>; Thu, 21 Mar 2019 22:28:30 -0700 (PDT)
Received: from straasha.imrryr.org (straasha.imrryr.org [100.2.39.101]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2AFEE130E9E for <uta@ietf.org>; Thu, 21 Mar 2019 22:28:30 -0700 (PDT)
Received: from [192.168.1.161] (unknown [192.168.1.161]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by straasha.imrryr.org (Postfix) with ESMTPSA id 77B6D31594B for <uta@ietf.org>; Fri, 22 Mar 2019 01:28:27 -0400 (EDT)
From: Viktor Dukhovni <ietf-dane@dukhovni.org>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Reply-To: uta@ietf.org
Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\))
Message-Id: <7BF97A13-E9D6-4E6E-AE75-C338D93334E3@dukhovni.org>
Date: Fri, 22 Mar 2019 01:28:27 -0400
To: uta@ietf.org
X-Mailer: Apple Mail (2.3445.102.3)
Archived-At: <https://mailarchive.ietf.org/arch/msg/uta/DZDcX4qwyvwtwkZnjhCWHaOU8mY>
Subject: [Uta] A quote from the cryptography list on security in practice.
X-BeenThere: uta@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: UTA working group mailing list <uta.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/uta>, <mailto:uta-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/uta/>
List-Post: <mailto:uta@ietf.org>
List-Help: <mailto:uta-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/uta>, <mailto:uta-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 22 Mar 2019 05:28:37 -0000

Reposted without asking permission, but I don't think Phillip Hallam-Baker will mind:

   ...  if security is going to be any use to people it has to be easy enough that a
   60+ year old grandmother who left school before the Internet arrived can use it
   because she is the US Secretary of State.

   We have tried the maximalist approach to security for 30 years and it has been a
   complete failure. We have one widely deployed Internet security protocol and it
   is limited to the transport layer.

It is with this in mind, that we can understand how some pragmatic security
concessions can ultimately gain more security for more users than they appear
to forgo at first glance.

-- 
	Viktor.