Re: [Uta] opportunistic keying / encryption considered of dubious value

[Leif Johansson <[e-mail]>]

On 2014-03-16 10:21, Keith Moore wrote:
> On 03/15/2014 08:14 PM, Alyssa Rowan wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA512
>>
>> On 15/03/2014 18:34, Keith Moore wrote:
>>
>>> I wonder whether it's worth the effort for us to specify, and for
>>> implementors to implement, uses of TLS that only provide encryption
>>> which is easily defeated by man in the middle attacks.
>> Yes.
>>
>> HTTP/2 (and other protocols) need it as their new baseline instead of
>> cleartext. It should never be presented as secure (https:), but it
>> defeats passive content analysis/manipulation. That is critical to
>> defeating deployed pervasive surveillance.
> Maybe I should have made my question a bit clearer.   My concern is that
> we'll go to the effort to specify, and implementors will go to the
> effort to implement, measures that only provide protection against
> passive eavesdropping.   Then MITM attacks will become more common, and
> we'll have squandered our opportunity to thwart them.

Speaking as an individual...

You seem to be assuming that it is possible to "just switch to MITM". I
believe there is evidence to suggest that active MITM attacks are either
targeted and expensive or pervasive and hilariously, possibly
prohibitively expensive.

I think that the point of the exercise: dramatically increase the cost
of pervasive attacks on the system so that a real cost/benefit analysis
has to be made before investing in them.

	Cheers Leif