Subject: [saag] Joel Jaeggli's Discuss on draft-dukhovni-opportunistic-security-05: (with DISCUSS)

From: "Joel Jaeggli" <[email-masked]>
Date: Tue, 25 Nov 2014 08:09:23 -0800

Joel Jaeggli has entered the following ballot position for
draft-dukhovni-opportunistic-security-05: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/draft-dukhovni-opportunistic-security/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

hanging on Ted's point a bit. I might clear if he does.

If the use of what are essentially transparent proxies makes downgrade
attacks, or effectively the removal of OE signaling entirely trivial then
certain people will do that routinetly in order to support all sorts of
ugly business models (the prexy is already there).

if you read about other cases that are effectively downgrades you can
sort of imagine how insidious it is to think you reducing the visible
surface area when in fact it's being stripped off again.

http://www.theregister.co.uk/2014/11/20/gotcha_google_caught_stripping_ssl_search_from_bt_wifi_users_searches/

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 25 Nov 2014 16:22:01 +0000

Joel,

> http://datatracker.ietf.org/doc/draft-dukhovni-opportunistic-security/

So a) I don't see what's different there compared to Ted's
discuss, b) Ted's discuss is (I think/hope) handled already
in an RFC editor note, and c) OS allows us to catch these
things (see "caught" in the URL above), wherewas with cleartext
we cannot.

So you need to explain to me what's discussable there since
I'm not getting it. (On the call is fine.)

S.

---

From: joel jaeggli <[email-masked]>
Date: Tue, 25 Nov 2014 08:24:56 -0800

> things (see "caught" in the URL above), wherewas with cleartext

I didn't want to see it cleared until I had evaluated the response to
his discuss.

So I agree there is not much to it.

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 25 Nov 2014 16:26:57 +0000

On 25/11/14 16:24, joel jaeggli wrote:
>>> When responding, please keep the subject line intact and reply
>>> to all email addresses included in the To and CC lines. (Feel
>>> free to cut this introductory paragraph, however.)
>>> 
>>> 
>>> Please refer to
>>> http://www.ietf.org/iesg/statement/discuss-criteria.html for
>>> more information about IESG DISCUSS and COMMENT positions.
>>> 
>>> 
- ----------------------------------------------------------------------
>>> 
>>> If the use of what are essentially transparent proxies makes
>>> downgrade attacks, or effectively the removal of OE signaling
>>> entirely trivial then certain people will do that routinetly in
>>> order to support all sorts of ugly business models (the prexy
>>> is already there).
>>> 
>>> if you read about other cases that are effectively downgrades
>>> you can sort of imagine how insidious it is to think you
>>> reducing the visible surface area when in fact it's being
>>> stripped off again.
>>> 
>> discuss, b) Ted's discuss is (I think/hope) handled already in an
>> RFC editor note, and c) OS allows us to catch these things (see
>> "caught" in the URL above), wherewas with cleartext we cannot.
> 
> I didn't want to see it cleared until I had evaluated the response
> to his discuss.
> 

Ah gotcha, that's fine

Ta,
S.

> 
>> So you need to explain to me what's discussable there since I'm
>> not getting it. (On the call is fine.)
>> 
>> S.
>> 
>> 
>>> 
>>> 
>>> 
>> 
> 
>

---

From: Ted Lemon <[email-masked]>
Date: Tue, 25 Nov 2014 11:38:44 -0500

> ugly business models (the prexy is already there).

This is now addressed in the RFC editor's note, and I am happy with the outcome.   YMMV, of course!   :)

---

From: joel jaeggli <[email-masked]>
Date: Tue, 25 Nov 2014 08:59:35 -0800

On 11/25/14 8:38 AM, Ted Lemon wrote:
>> ugly business models (the proxy is already there).
> 

yeah I'm not super happy with

   However, when such attacks are
   employed pervasively in order to facilitate e,g, surveillance,
   this is readily detectable; hence, even in such scenarios
   OS protocols provide a positive benefit.

e.g. if today 70% of my servers outgoing smtp connections use start-tls
and tomorrow 67% use them is that evidence of an attack?

there are many cases where these are in fact not readily detectable so
this statment provides more certainty then it should.

I'm ok with the uncertainty (it's inevitable I think) but  not with our
statement of it yet.

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 25 Nov 2014 17:01:59 +0000

On 25/11/14 16:59, joel jaeggli wrote:
>>> order to support all sorts of ugly business models (the proxy
>>> is already there).
>> 
> However, when such attacks are employed pervasively in order to
> facilitate e,g, surveillance, this is readily detectable; hence,
> even in such scenarios OS protocols provide a positive benefit.
> 
> e.g. if today 70% of my servers outgoing smtp connections use
> start-tls and tomorrow 67% use them is that evidence of an attack?
> 
> there are many cases where these are in fact not readily detectable
> so this statment provides more certainty then it should.
> 
> I'm ok with the uncertainty (it's inevitable I think) but  not with
> our statement of it yet.

Got any words to suggest?

Would s/readily/often/ be enough?

S.

> 
> 
>> 
> 
> 
> 
> 
> _______________________________________________ saag mailing list 
> [email-masked] https://www.ietf.org/mailman/listinfo/saag
>

---

From: Ted Lemon <[email-masked]>
Date: Tue, 25 Nov 2014 12:04:12 -0500

> and tomorrow 67% use them is that evidence of an attack?

I think your bar for "readily detectable" is too high.   In the example you give, it would be a fairly straightforward statistical analysis problem to show whether this is coincidence or enemy action.  E.g., if you have a lot of new users and they are all using cleartext, that's okay.   If you have a lot of the same users, and suddenly 3% more of them are using cleartext, that's probably enemy action.

Remember that OS works best to change _how much_ surveillance succeeds, not to _prevent_ surveillance.   So there are no guarantees.   We're just trying to throw a spanner in the surveillance works here.

---

From: joel jaeggli <[email-masked]>
Date: Tue, 25 Nov 2014 09:21:25 -0800

> Would s/readily/often/ be enough?

often / probably / should be / might be

is probably a spectrum, it's better than readily.

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 25 Nov 2014 17:23:45 +0000

> often / probably / should be / might be

"often" it is - done now

S.

---

From: joel jaeggli <[email-masked]>
Date: Tue, 25 Nov 2014 09:26:17 -0800

>> often / probably / should be / might be

often works,

I was in the process of clearing anyway.

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 25 Nov 2014 17:27:35 +0000

> I was in the process of clearing anyway.

Thanks,
S.