Subject: [perpass] In case you haven't seen it yet...

From: "Fred Baker (fred)" <[email-masked]>
Date: Wed, 26 Feb 2014 08:58:29 +0000

http://windowsitpro.com/identity-management/richard-clarke-rsa-conference-10-observations-us-intelligence-gathering

---

From: Ted Lemon <[email-masked]>
Date: Wed, 26 Feb 2014 08:07:30 -0500

> http://windowsitpro.com/identity-management/richard-clarke-rsa-conference-10-observations-us-intelligence-gathering

Thanks.   Interesting article.

---

From: [email-masked]
Date: Wed, 26 Feb 2014 08:35:44 -0500 (EST)

Fred,

Among other interesting infos, the article is in favor of cloud computing and its security.

Question: In case some crime happens with data in the cloud which country is in charge to prosecute?

Heiner

-----Ursprüngliche Mitteilung----- 
Von: Fred Baker (fred) <[email-masked]>
An: perpass <[email-masked]>
Verschickt: Mi, 26 Feb 2014 9:58 am
Betreff: [perpass] In case you haven't seen it yet...

_______________________________________________
perpass mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/perpass

---

From: Spencer Dawkins at IETF <[email-masked]>
Date: Thu, 27 Feb 2014 13:57:46 -0600

Fred, I echo Ted's thanks.

Something to muse about on the flight to London ...

Spencer

On Wednesday, February 26, 2014, Ted Lemon <[email-masked]> wrote:

> On Feb 26, 2014, at 3:58 AM, Fred Baker (fred) <[email-masked]<javascript:;>>
> wrote:
> >
> [email-masked] <javascript:;>

---

From: Douglas Otis <[email-masked]>
Date: Thu, 27 Feb 2014 12:52:47 -0800

Dear Perpass WG,

Technological solutions can address most security issues.  Those related to PKI limitations can be addressed with DNSSEC and DANE, for example.  Regardless of the number of hops, protocols such as XMPP's direct federation model can ensure multiple hop security.  Of course, not all federations require full compliance, but at least XMPP offers a means.

The level of abuse and risk associated with lax management found with email is likely responsible for a shift away from services dominated by mass mailers and toward those suitable for individuals as characterized by growing social networks.  Even so, most social networks also represent a potential for substantial privacy intrusion.

The IETF could do more at reducing these exposures.  Moving from SMTP to XMPP is not insurmountable, especially when it offers greater security with reduced complexity when dealing with threats.  Such a transition offers a means to bolster waning system security and use. 

The IETF has done well to discourage email prompted exchange of "office" documents.  Such exchanges represent a major and common exploit vector, especially when from unknown sources.  Any such exchange must be considered a bad practice.   The explosion of browser plugins and Apps from poorly vetted sources however are of equal concern and also demand source confirmation as well.

More consideration needs to be made regarding both client and server certificates that can be exchanged with TLS, otherwise MiTM attacks may go undetected.  It is also wrong to suggest IPv6 now offers secure BGP and is immune to address spoofing.  The size of the IPv6 prefix address space precludes effective sharing of threats at being effective in mitigating abuse.  Authenticated domains representing both ends of an exchange promise more effective protection strategies.

Please forgive any apparent lack of etiquette, as there is no intent to demean anyone.

Regards,
Douglas Otis