Re: [Uta] Opportunistic encryption and authentication agility

[Trevor Perrin <[e-mail]>]

On Tue, Mar 25, 2014 at 1:24 PM, William Chan (陈智昌)
<[e-mail]> wrote:
> On Tue, Mar 25, 2014 at 1:09 PM, Trevor Perrin <[e-mail]> wrote:
>>
>> On Mon, Mar 24, 2014 at 9:51 AM, Daniel Kahn Gillmor
>> <[e-mail]> wrote:
>> > On 03/24/2014 12:36 PM, Keith Moore wrote:
>> >
>> >> So, what's the incentive for either clients or servers to support OE if
>> >> clients just silently accept it without any indication to the user?
>> >> Just for the good of mankind?
>> >
>> > I'd say "to increase the cost of pervasive monitoring" and "to resist
>> > surveillance by passive attackers"
>>
>> I'd go further - OE for HTTP could have strong auth added to it in the
>> future, such as pinning or DANE, which *could* be indicated to the
>> user.
>
>
> Please be cautious about suggesting user indications. UI is complicated and
> all that. More specifically in the browser case, even if you could strongly
> authenticate a connection over which you request a http:// page, I wouldn't
> want to give that page the https lock treatment. Note that https:// has
> different semantics (referer semantics, mixed content, etc).

Good points, thanks.  Maybe adding other auth methods to HTTP-over-TLS
would be best done silently, with no UI unless a security failure
occurs?

I think I like that, as I think catching "badness" is more useful than
indicating "goodness".  But these are hard Qs, I'm just trying point
out some possibilities at this point.


Trevor