Subject: [perpass] Crypto scorecard released by EFF

From: "Moriarty, Kathleen" <[email-masked]>
Date: Wed, 20 Nov 2013 17:08:25 -0500

EFF released a 'report card' for encryption capabilities of 18 companies and may be of interest to many of you.  It is meant as a positive encouragement to other companies to expand crypto capabilities per the web link.

http://threatpost.com/eff-scorecard-shows-crypto-leaders-and-laggards/102987

Best regards,
Kathleen

---

From: "Fred Baker (fred)" <[email-masked]>
Date: Wed, 20 Nov 2013 22:20:13 +0000

On Nov 20, 2013, at 2:08 PM, "Moriarty, Kathleen" <[email-masked]> wrote:

> EFF released a ‘report card’ for encryption capabilities of 18 companies and may be of interest to many of you.  It is meant as a positive encouragement to other companies to expand crypto capabilities per the web link.
>  
 
Hmm. A chart with rows and columns. The rows have logos on them. The columns are unidentified...

> Best regards,
> Kathleen
>  
> _______________________________________________
> perpass mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/perpass

-----------------------------------
"We are learning to do a great many clever things...The next great task
will be to learn not to do them."

- G. K. Chesterton (1874-1936)

---

From: "Moriarty, Kathleen" <[email-masked]>
Date: Wed, 20 Nov 2013 17:23:39 -0500

I had the same problem and had to let the page load.  The survey is tracking the following in the columns:
Encrypts data center links
Supports HTTPS
HTTPS Strict (HSTS)
Forward Secrecy
STARTTLS

Best regards,
Kathleen

From: Fred Baker (fred) [mailto:[email-masked]]
Sent: Wednesday, November 20, 2013 5:20 PM
To: Moriarty, Kathleen
Cc: [email-masked]
Subject: Re: [perpass] Crypto scorecard released by EFF

On Nov 20, 2013, at 2:08 PM, "Moriarty, Kathleen" <[email-masked]<mailto:[email-masked]>> wrote:

Best regards,
Kathleen

_______________________________________________
perpass mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/perpass

---

From: Ted Lemon <[email-masked]>
Date: Wed, 20 Nov 2013 17:35:47 -0500

> Hmm. A chart with rows and columns. The rows have logos on them. The columns are unidentified...

You have to go to the EFF article.   Thanks for the link, Kathleen.   I discovered a couple of examples of this problem last night; it's good to have a more complete reckoning.

---

From: Richard Barnes <[email-masked]>
Date: Thu, 21 Nov 2013 14:57:31 -0500

The link:
https://www.eff.org/deeplinks/2013/11/encrypt-web-report-whos-doing-what#crypto-chart

On Wed, Nov 20, 2013 at 5:23 PM, Moriarty, Kathleen <
[email-masked]> wrote:

> *From:* Fred Baker (fred) [mailto:[email-masked]]
> *Sent:* Wednesday, November 20, 2013 5:20 PM
> *To:* Moriarty, Kathleen
> *Cc:* [email-masked]
> *Subject:* Re: [perpass] Crypto scorecard released by EFF
>
>
>
>
>
> EFF released a ‘report card’ for encryption capabilities of 18 companies
> and may be of interest to many of you.  It is meant as a positive
> encouragement to other companies to expand crypto capabilities per the web
> link.
>
>
>
>

---

From: [email-masked]
Date: Thu, 21 Nov 2013 14:32:41 -0800 (PST)

> https://www.eff.org/deeplinks/2013/11/encrypt-web-report-whos-doing-what#crypto-chart

Too bad the creators of this survey had no idea what they were doing when it
comes to email. For one thing web access != webmail != IMAP/POP/SUBMIT, and it
is a known fact that several of these vendors, e.g., Yahoo, require SSL/TLS for
some of these and don't allow it at all for others. (This was one of the big
holes the NSA exploited, so yeah, it matters.)

And for another, STARTTLS as presently specified is *not* an opportunistic
encryption facility. And there are significant operational problems with using
it that way. I've already discussed why this is so elswhere so I won't bother
to repeat the details here.

				Ned

---

From: SM <[email-masked]>
Date: Thu, 21 Nov 2013 15:47:09 -0800

Hi Kathleen,

[Courtesy copy to one of the authors of the article]

At 14:08 20-11-2013, Moriarty, Kathleen wrote:
>EFF released a 'report card' for encryption capabilities of 18 
>companies and may be of interest to many of you.  It is meant as a 
>positive encouragement to other companies to expand crypto 
>capabilities per the web link.

Ned already commented [1] on the report.  The report's title is 
"Encrypt the Web Report".  The reports discusses about mail (SMTP, 
IMAP, etc).  That's not the web in my humble opinion.  The last row 
in the second column (https) mentions mail.  Mixing mail and web 
creates a confusing picture.  The end-result is that the chart can 
lead to misinterpretation.

Regards,
-sm

1. http://www.ietf.org/mail-archive/web/perpass/current/msg01106.html