Subject: [saag] Joel Jaeggli's No Objection on draft-dukhovni-opportunistic-security-05: (with COMMENT)

From: "Joel Jaeggli" <[email-masked]>
Date: Tue, 25 Nov 2014 09:24:54 -0800

Joel Jaeggli has entered the following ballot position for
draft-dukhovni-opportunistic-security-05: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/draft-dukhovni-opportunistic-security/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

woud prefer

 However, when such attacks are employed pervasively in order to
 facilitate e,g, surveillance, this is probably detectable; hence,
 even in such scenarios OS protocols may provide a positive benefit.

but I've said my piece and I will trust the shepherding AD.

was:

hanging on Ted's point a bit. I might clear if he does.

If the use of what are essentially transparent proxies makes downgrade
attacks, or effectively the removal of OE signaling entirely trivial then
certain people will do that routinetly in order to support all sorts of
ugly business models (the prexy is already there).

if you read about other cases that are effectively downgrades you can
sort of imagine how insidious it is to think you reducing the visible
surface area when in fact it's being stripped off again.

http://www.theregister.co.uk/2014/11/20/gotcha_google_caught_stripping_ssl_search_from_bt_wifi_users_searches/

---

From: Ted Lemon <[email-masked]>
Date: Tue, 25 Nov 2014 12:29:50 -0500

> even in such scenarios OS protocols may provide a positive benefit.

WFM