Subject: [saag] stopping (https) phishing

From: Henry Story <[email-masked]>
Date: Sun, 1 Jul 2018 12:07:27 +0100

Dear all,

  Recently the APWG (Anti-Phishing Working Group) reported a 6 fold increase in 2017 
of phishing sites located on https servers. The aim of the phishers is to mislead people 
into a false sense of confidence by using the green padlock that appears in some browsers
when landing on a site, which is understood to mean "secure". People misunderstand
this to mean they have landed on a legitimate website. With the great work of letsencrypt.org
getting TLS sites is easier and easier, which is good: because that stops all kinds of man
in the middle nonsense. But it reveals what has always been missing.

  What is missing is the socio-technical piece of the stack that would allow the icon
to mean "legitimate", ie. embedded in a legal system of a country. I argue in this paper
which I am working on as part of my PhD thesis that this requires an institutional web of
trust, which needs the cooperation of some leading nations, the IETF and W3C.

   Stopping (https) phishing
   https://medium.com/@bblfish/stopping-https-phishing-42226ca9e7d9

I'd be interested to hear what issues people here see with the approach outlines there,
so that I can try to address them, or move onto something else :-)

	Henry Story

        PhD researcher on SocialMachines and CyberSecurity 
        at Southampton University

---

From: Tim Hollebeek <[email-masked]>
Date: Sat, 14 Jul 2018 17:44:01 +0000

This is a very important problem, and what you referenced is a nice analysis
of some of the complexities involved when trying to solve it.  It is far
from easy and makes a good PhD topic.

The one thing that I'd caution you on is that loading external resources
asynchronously as part of verifying a page load is pretty much a
non-starter.  Any solution that has an impact on web performance will not be
adopted at scale.

Browser validation needs to be able to happen exclusively using information
provided by the server.  That information needs to be cryptographically
signed by others (just as SCTs, OCSP-stapled responses, etc are) so it can
be trusted.

I would suggest thinking about what sort of additional identity information
is useful to stop https phishing, and how it can be securely distributed
from authoritative sources to endpoints for use in their trust decisions,
with minimal changes to the way things work today.

There are lots of aspects to that and you're probably going to have to pick
a small subset of the problem and see if you can find useful contributions
in a reasonable amount of time ...

-Tim

> -----Original Message-----
> From: saag [mailto:[email-masked]] On Behalf Of Henry Story
> Sent: Sunday, July 1, 2018 7:07 AM
> To: [email-masked]
> Subject: [saag] stopping (https) phishing
> 
> Dear all,
> 
>   Recently the APWG (Anti-Phishing Working Group) reported a 6 fold
increase
> in 2017 of phishing sites located on https servers. The aim of the
phishers is to
> mislead people into a false sense of confidence by using the green padlock
> that appears in some browsers when landing on a site, which is understood
to
> mean "secure". People misunderstand this to mean they have landed on a
> legitimate website. With the great work of letsencrypt.org getting TLS
sites is
> easier and easier, which is good: because that stops all kinds of man in
the
> middle nonsense. But it reveals what has always been missing.
> 
>   What is missing is the socio-technical piece of the stack that would
allow the
> icon to mean "legitimate", ie. embedded in a legal system of a country. I
argue
> in this paper which I am working on as part of my PhD thesis that this
requires
> an institutional web of trust, which needs the cooperation of some leading
> nations, the IETF and W3C.
> 
> I'd be interested to hear what issues people here see with the approach
> outlines there, so that I can try to address them, or move onto something
else
> :-)
> _______________________________________________
> saag mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/saag

---

From: "John Levine" <[email-masked]>
Date: 14 Jul 2018 20:44:20 -0400

>with minimal changes to the way things work today.

This is a really hard problem for a variety or reasons.  One is that
this is a user interface issue, and the IETF is notably clueless about
UI.

A long time ago, I suggested industry-specific CAs tied to regulators
or trade associations, with the logo of the CA in the cert that can be
displayed in a distinctive place in the browser.  For example, for
banks in the US the CA would be associated with the FDIC and the cert
would show the FDIC logo, like the sticker on the door of your bank
branch.

I don't know how well this would work in practice, since users are not
very good at understanding that a marker (lock, logo, whatever) in the
chrome is different from the same marker in the window, but given that
anyone can get https for free these days, we need a different way to
mark high-value phish targets.

R's,
John

---

From: Viktor Dukhovni <[email-masked]>
Date: Sat, 14 Jul 2018 21:51:27 -0400

> mark high-value phish targets.

My personal preference would be for the browser to associate
*personal* visual clues with previously visited and well known
sites, and to issue warnings for domains with a low edit distance
from such sites.

In late June, hastily packing for a trip, I was rebuilding a MacOS
image from scratch, while not wearing my reading glasses.  I tried
to use the bundled browser to download Firefox, from (not quite the
right site): moizlla.com.  This prompted for a Flash update, which
sadly in that context did not seem too suspicious (did Safari in
the OS image perhaps bundle a slightly stale copy of Flash?).
Quickly realized that was a mistake.  Erased the filesystem and
re-installed.  Illusions that this can never happen to an old salt
like me now in tatters. :-(

Not an easy problem to solve, but I don't think that centralized
systems alone can solve it.  Solutions are necessarily incomplete,
multi-faceted and coëvolving with the attacks.

-- 
	Viktor.

---

From: Tim Hollebeek <[email-masked]>
Date: Sun, 15 Jul 2018 13:12:38 +0000

So, I would make three points:

1. UI solutions and problems have been discussed for about ten years,
with no progress either on the PKI side or the UI side.  Improvements along 
the lines of what Viktor mentions are in my mind overdue, and I would 
urge browser UX teams and researchers to give serious attention to them.
I get very frustrated when security systems we rely upon do not improve 
for a decade or more.

2. There is a fraction of users that could consume UI information, but the
UI has to be willing to teach/train them.  It's fairly clear that untrained
users cannot consume security UI.  Some of the "privacy review" and
"security review" training that some applications and sites offer is perhaps
something to look at.  There are users who *want* to be able to consume
security UI, and are willing to spend some time learning best practices and
what to look for.

3. Identity information has value *beyond* the UI.  Increasingly, there are
researchers, automated systems, and security systems that could consume
validated identities.  They may benefit from richer and better vetted
identity information, with clear and auditable rules about how such
identities were verified, so they can be used in trust decisions.  There are
various classes of identity information like GLEIF, and various ETSI standards
for including validated identity information in certificates that I wish I
understood better than I do.

I was actually a Research Scientist for almost a decade, so if anyone wants
to brainstorm about these issues, feel free to track me down in Montreal.

-Tim

-Tim

> From: saag [mailto:[email-masked]] On Behalf Of Viktor Dukhovni
> Sent: Saturday, July 14, 2018 9:51 PM
> To: [email-masked]
> Subject: Re: [saag] stopping (https) phishing
> 
> *personal* visual clues with previously visited and well known sites, and to
> issue warnings for domains with a low edit distance from such sites.
> 
> In late June, hastily packing for a trip, I was rebuilding a MacOS image from
> scratch, while not wearing my reading glasses.  I tried to use the bundled
> browser to download Firefox, from (not quite the right site): moizlla.com.  This
> prompted for a Flash update, which sadly in that context did not seem too
> suspicious (did Safari in the OS image perhaps bundle a slightly stale copy of
> Flash?).
> Quickly realized that was a mistake.  Erased the filesystem and re-installed.
> Illusions that this can never happen to an old salt like me now in tatters. :-(
> 
> Not an easy problem to solve, but I don't think that centralized systems alone
> can solve it.  Solutions are necessarily incomplete, multi-faceted and
> coëvolving with the attacks.
> 
> --
> 	Viktor.
>

---

From: Henry Story <[email-masked]>
Date: Sun, 15 Jul 2018 19:56:04 +0200

Hi, 

   I just wrote up some ideas on UI and security that came (back) to me reading 
this thread and other interesting papers on security.

"Phishing in Context -- Epistemology on the screen"
 https://medium.com/@bblfish/phishing-in-context-9c84ca451314 <https://medium.com/@bblfish/phishing-in-context-9c84ca451314>

This gives a (psycho)logical analysis of UI elements of phishing and 
a proposal for how to answer that using a great idea by Apple ....

I think it meshes quite well with the points made in this thread.

> On 15 Jul 2018, at 15:12, Tim Hollebeek <[email-masked] <mailto:[email-masked]>> wrote:
> 

I think I just spotted a major possibility related to a recent (but not so recent)
innovation by Apple...

> security UI, and are willing to spend some time learning best practices and

yes, so there I think if the information is richer then it is possible to 
give the user something interesting to look at. The fixed headquarters address
that exists currently in DV certificates is useless: nobody understands why they
would need to look at that - expcept perhaps for security specialists who understand
that the headquarters are useful for legal reasons...

The reason an institutional web of trust can bring a lot richer information
that can change, is that it can be served in real time by an agency. Some
information can be unchanging in a  cert, but other information can be available
live from a server, which with the future Quic protocol could be very light weight.
I think in any case one could mix and match.

But what is sure: with the current cert info there was nothing a designer could
do to make it appealing. So I think more intelligent information that can change
would give Designers something to make security appealing.

> understood better than I do.

Certainly. And I think because it is such a big field with so much potential, 
we need to be prepared to accept that we will step into the logical mirror of
functional thinking. Weirdly enough the category of finite Boolean algebras 
is dual to that of sets and functions

https://math.stackexchange.com/questions/980933/what-is-the-opposite-category-of-set <https://math.stackexchange.com/questions/980933/what-is-the-opposite-category-of-set>
> to brainstorm about these issues, feel free to track me down in Montreal.

Currently I am on a low student budget in the mountains of Germany (Garmisch-Partenkirchen).
Always happy to chat around here. Perhaps I'll be at W3C TPAC in Lyon too.

>> From: saag [mailto:[email-masked] <mailto:[email-masked]>] On Behalf Of Viktor Dukhovni
>> To: [email-masked] <mailto:[email-masked]>
>> browser to download Firefox, from (not quite the right site): moizlla.com <http://moizlla.com/>.  This
>> [email-masked] <mailto:[email-masked]>
> [email-masked] <mailto:[email-masked]>

---

From: Ben Laurie <[email-masked]>
Date: Sun, 15 Jul 2018 21:34:41 +0100

On Sun, 15 Jul 2018 at 18:56, Henry Story <[email-masked]> wrote:

>  https://medium.com/@bblfish/phishing-in-context-9c84ca451314
>

You have reinvented the Secure Attention Key. It hasn't work out that well,
so far.

---

From: Henry Story <[email-masked]>
Date: Sun, 15 Jul 2018 23:43:18 +0200

> On 15 Jul 2018, at 22:34, Ben Laurie <[email-masked]> wrote:
> 
> 
> 
> You have reinvented the Secure Attention Key. It hasn't work out that well, so far.
> 

Do you mean what they describe on wikipedia here ?
https://en.wikipedia.org/wiki/Secure_attention_key 

"A secure attention key (SAK) or secure attention sequence (SAS) is a special key or key combination to be pressed on a computer keyboard before a login screen which must, to the user, be completely trustworthy. The operating system kernel, which interacts directly with the hardware, is able to detect whether the secure attention key has been pressed. When this event is detected, the kernel starts the trusted login processing."

That would be to authenticate the user of the computer, which is I suppose a 
predecessor of what the fingerprint button on new MacBook Pro laptops is about 
(I don't know, as I don't have them). They call it Touch Id 
https://support.apple.com/en-us/HT207054

But that is not what I am talking about in the article. There I am speaking of server
or application authentication, and I am arguing that to be secure this needs two screens
the second screen being what Apple calls the Touch Bar. There is a video here describing it
    https://youtu.be/DhCJuJoE6wM?t=170
But I am sure you'll find many more. (Btw. the new Mac Book Pro is out today!)

I would guess that parts of the Touch Bar must be OS secured, or else an app could get your fingerprints? In any case I am saying that there should be a couple more buttons on the Touch Bar that are controlled by the OS.
1) the icon of the App that is in the foreground ( which would be retrieved from the institutional web of trust
2) the icon of the favicon of the web page also retrieved from the institutional web of trust

clickin those would give you more information about the app in 1) and more info about the page in 2).
But not just the address of the headquarters, but something a lot richer....

But I may have misunderstood you...?

Henry

---

From: Ben Laurie <[email-masked]>
Date: Sun, 15 Jul 2018 22:45:49 +0100

No, I mean in the more general sense that its a way to invoke "the system",
guaranteed, no messing.

It has a noble history of not working very well.

Windows uses ctl-alt-del as a SAK. It doesn't let you do much, but it is
more than login.

On Sun, 15 Jul 2018 at 22:43, Henry Story <[email-masked]> wrote:

> "A secure attention key (SAK) or secure attention sequence (SAS) is a
> special key or key combination to be pressed on a computer keyboard before
> a login screen which must, to the user, be completely trustworthy. The
> operating system kernel, which interacts directly with the hardware, is
> able to detect whether the secure attention key has been pressed. When this
> event is detected, the kernel starts the trusted login processing."
>
> I would guess that parts of the Touch Bar must be OS secured, or else an
> app could get your fingerprints? In any case I am saying that there should
> be a couple more buttons on the Touch Bar that are controlled by the OS.
> 1) the icon of the App that is in the foreground ( which would be
> retrieved from the institutional web of trust

---

From: Henry Story <[email-masked]>
Date: Mon, 16 Jul 2018 00:21:39 +0200

> On 15 Jul 2018, at 23:45, Ben Laurie <[email-masked]> wrote:
> 
> No, I mean in the more general sense that its a way to invoke "the system", guaranteed, no messing.
> 
> Windows uses ctl-alt-del as a SAK. It doesn't let you do much, but it is more than login.

Over my life working with computers from 1980ies onwards, I have seen many attempts
of ideas that failed, and then when the time was right and the pieces came together things started
working. To witL The Minitel gave the French a great view into the future of hypertext, but not
being open was a key limitation. I can just imagine people wondering how would open software
and standards be a deal breaker on hypertext?

My argument in this case is one that comes from mathematical doxastic logic. There has to be a way
to know who said what. Which app is controlling the screen? What page is the app showing?
These are key logical features that a single screen cannot provide, as it is always possible
to fool the user by duplicating the experience. Hence you need two screen, just as in logic you need
to distinguish between the content and the agent asserting the content. In RDF this is the shift
between triples and quads.

Now Apple actually ships laptops with two screens.... They don't seem to be using it the right 
way for me, but then the institutional web of trust I describe in the original article of this thread is not 
there yet either... It's just a matter of time thought until it is realized.

You cannot argue from an idea has not succeeded that it will never succeed, in the same way 
but in reverse that Bertrand Russell's chicken would be foolish to go from the friendliness of the 
farmer today  to his friendliness tomorrow.

Henry

> 
> On Sun, 15 Jul 2018 at 22:43, Henry Story <[email-masked] <mailto:[email-masked]>> wrote:
> 
> 
> > On 15 Jul 2018, at 22:34, Ben Laurie <[email-masked] <mailto:[email-masked]>> wrote:
> > 
> > 
> > 
> > On Sun, 15 Jul 2018 at 18:56, Henry Story <[email-masked] <mailto:[email-masked]>> wrote:
> > Hi, 
> > 
> https://en.wikipedia.org/wiki/Secure_attention_key <https://en.wikipedia.org/wiki/Secure_attention_key> 
> 
> https://support.apple.com/en-us/HT207054 <https://support.apple.com/en-us/HT207054>
> 
>     https://youtu.be/DhCJuJoE6wM?t=170 <https://youtu.be/DhCJuJoE6wM?t=170>

---

From: Henry Story <[email-masked]>
Date: Mon, 16 Jul 2018 10:48:10 +0200

> On 15 Jul 2018, at 03:51, Viktor Dukhovni <[email-masked]> wrote:
> 

Yes, so that is what I looked at in the short 6 minute read blog post
I wrote up over the weekend. 

"Phishing in Context"

I start with the 2002 Usenix paper "Trusted paths for Browsers"
where the authors where able to completely take over the Chrome.
How can one stop that!? I think the idea that nothing can be done
in UI space stems from the medusing stare of that possibility.

> sites, and to issue warnings for domains with a low edit distance

Yep, I think that can also be added.

> like me now in tatters. :-(

yes, so in the proposal since you would never have gone to moizilla.com
before you would have first gotten your browser to open a Moizilla 
information site that would presumably contain mostly question marks,
 since it is unlikely  that they would want to tie themselves to a legal 
system of institutional trust. That or they would try to base their company
in a location known to be unreliable (according to your trust source), 
and the UI would have been in red to highlight a danger zone. 

But even if you had downloaded it, the icon on your Touch Bar
would have been one that would not match the one you were used to from
Firefox. And if someone anywhere were to work out the scam, then you
could get an official news info on your Touch Bar to warn 
you about the software.

The importance of that second screen can not be underestimated.
It really has the feeling of a being an engineering embodiment
of a logical necessity.

> multi-faceted and coëvolving with the attacks.

yes! 

The institutional web of trust is both actually. It has a peer
to peer side that is the relation between the states, and a hierarchical
relation between organizations inside a state.

I am reading a recent paper just now that is following up on some similar 
architectural ideas under the name of Bridge Certification Authorities, ... 
But those look from a distance to be brittle because they tie themselves to X509 
certificates where  I think one needs to be able to swerve elegantly between signed 
certificates and data on the web.  But I have to get a better understanding of 
Trust Brokers to see what is going on there...

 https://www.hindawi.com/journals/scn/2017/6907146/abs/

---

From: Michael Richardson <[email-masked]>
Date: Mon, 16 Jul 2018 10:12:19 -0400

> Windows uses ctl-alt-del as a SAK. It doesn't let you do much, but it

Yes, that's just it: it doesn't do that much.
That's why it was a failure.  Also lack of any kind of tutorial.
And since it used to reboot the computer, so most people habitually avoid it.

It's probably time to try it again.

    
    > "A secure attention key (SAK) or secure attention sequence (SAS)
    > is a special key or key combination to be pressed on a computer
    > keyboard before a login screen which must, to the user, be
    > completely trustworthy. The operating system kernel, which
    > interacts directly with the hardware, is able to detect whether
    > the secure attention key has been pressed. When this event is
    > detected, the kernel starts the trusted login processing."

    
    > I would guess that parts of the Touch Bar must be OS secured, or
    > else an app could get your fingerprints? In any case I am saying
    > that there should be a couple more buttons on the Touch Bar that
    > are controlled by the OS.
    
    > But not just the address of the headquarters, but something a lot
    > richer.....

    > ----------------------------------------------------
    > Alternatives:

    > ----------------------------------------------------

-- 
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Bret Jordan <[email-masked]>
Date: Fri, 20 Jul 2018 17:51:15 -0400

Getting back on topic.  I agree this is a significant problem, one that needs to be addressed.  While things like LetsEncrypt are great for trying to get everyone a cert for free, it also means, Threat Actors and Intrusion Sets can get free certs as well. 

Thanks,
Bret
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."

> On Jul 16, 2018, at 10:12 AM, Michael Richardson <[email-masked]> wrote:
> 
> 
> Ben Laurie <benl=[email-masked] <mailto:benl=[email-masked]>> wrote:
>> https://www.ietf.org/mailman/listinfo/saag <https://www.ietf.org/mailman/listinfo/saag>
> 
> -- 
> Michael Richardson <[email-masked] <mailto:[email-masked]>>, Sandelman Software Works
> https://www.ietf.org/mailman/listinfo/saag <https://www.ietf.org/mailman/listinfo/saag>

---

From: Henry Story <[email-masked]>
Date: Sat, 21 Jul 2018 10:15:02 +0200

> On 20 Jul 2018, at 23:51, Bret Jordan <[email-masked]> wrote:
> 

Yes, it looks like there is a sea change with regard to use of TLS, which is leading 
Chrome next week  according to the register [1] to stop showing the padlock icon for
secure sites, and instead show a warning for non-https sites, which will further
accelerate the adoption of https, something made possible by LetsEncrypt.

So very soon everyone including the crooks will be behind https :-) 
It will be the new default.

From then on the point to point security will have been dealt with (especially 
if  DANE also gets adopted that far), and all that will remain is the question as to
who am I talking to so securely?

That is the question of the identity of the web site the browser or application
is  connected to, indeed the question of the identity of the application controlling
the screen more generally [2]. 

If one is of a category theoretic mind one will think that the identity of each
object is its position in the network of arrows of the category. But more practically
end users will be interested for applications or web site of knowing what legal
space they are in. For personal web pages we can fall back to the web of trust
we currently have. 

That is actually quite a large project, but given that one is dealing with nations
that have the resources, it is quite feasible.

But that was the point of my original post. :-) 

Henry

[1] https://www.theregister.co.uk/2018/07/03/google_chrome_http/
[2] The 2015 paper "What is that App? Deceptions and countermeasures 
in the Android User Interface" 
    https://www.computer.org/csdl/proceedings/sp/2015/6949/00/6949a931-abs.html
I integrated that article in the  "Phishing in Context" post this week.

>> On Jul 16, 2018, at 10:12 AM, Michael Richardson <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> 
>>>> On Sun, 15 Jul 2018 at 18:56, Henry Story
>>> <[email-masked] <mailto:[email-masked]>> wrote:
>>>> Hi, 
>>>>

---

From: Bret Jordan <[email-masked]>
Date: Sat, 21 Jul 2018 08:27:02 -0400

I completely agree.  We need to figure what we can do and specifically how we can enable better protection for end users.  Having a completely secure and private session is solving just half of the problem.  

What do you suggest is the next steps forward?  Clearly we need to do work here.  I would love to see some work done here in the IETF to help with this.  

As you have said attribution is one option. I think it would be good for end users to know if they were connecting to a legally legit establishment or a crime syndicate fronting an Intrusion Set.

Bret 

Sent from my Commodore 128D

> On Jul 21, 2018, at 4:15 AM, Henry Story <[email-masked]> wrote:
> 
> 
> 
>>>> <[email-masked]> wrote:
>>>>> Hi, 
>>>>>

---

From: Josh Howlett <[email-masked]>
Date: Sat, 21 Jul 2018 14:14:21 +0000

A “completely secure and private session” where the identity of the end point has not been appropriately validated actually makes the problem worse, because it can lead to erroneous assumptions by the user. Similarly, extended validation of the end point achieves nothing if the end point is a highly assured but untrustworthy actor.

Should I trust a CA to issue an EV certificate appropriately? Yes, probably. Should I blindly trust the CA’s customer simply because it presents an EV certificate? No, probably not. Ultimately, we cannot control behaviour using crypto: poor behaviour is a social problem.

I agree with Henry’s analysis that we can only solve this by projecting the social institutions (formal or informal) that we use to assess trustworthiness in the real world onto the internet’s infrastructure (I call it “trust engineering”; a benign form of “social engineering”).

However, I disagree that chrome offers a solution. I argue that we must avoid any kind of real-time assessment of trustworthiness by the user, because users are easily gamed. Instead, users should be able to stipulate the conditions that constitute trustworthiness, and rely on the infrastructure to assess those conditions in real-time on his behalf.

From: saag <[email-masked]> On Behalf Of Bret Jordan
Sent: 21 July 2018 13:27
To: Henry Story <[email-masked]>
Cc: [email-masked]
Subject: Re: [saag] stopping (https) phishing

Bret

On Jul 21, 2018, at 4:15 AM, Henry Story <[email-masked]<mailto:[email-masked]>> wrote:

On 20 Jul 2018, at 23:51, Bret Jordan <[email-masked]<mailto:[email-masked]>> wrote:

Henry

Thanks,
Bret

On Jul 16, 2018, at 10:12 AM, Michael Richardson <[email-masked]<mailto:[email-masked]>> wrote:

Ben Laurie <benl=[email-masked]<mailto:benl=[email-masked]>> wrote:

No, I mean in the more general sense that its a way to invoke "the
system", guaranteed, no messing.

Windows uses ctl-alt-del as a SAK. It doesn't let you do much, but it
is more than login.

On 15 Jul 2018, at 22:34, Ben Laurie <[email-masked]<mailto:[email-masked]>> wrote:

On Sun, 15 Jul 2018 at 18:56, Henry Story
<[email-masked]<mailto:[email-masked]>> wrote:

Hi,

I just wrote up some ideas on UI and security that came (back)
to me reading

You have reinvented the Secure Attention Key. It hasn't work out
that well, so far.

That would be to authenticate the user of the computer, which is I
suppose a
predecessor of what the fingerprint button on new MacBook Pro
laptops is about
(I don't know, as I don't have them). They call it Touch Id
https://support.apple.com/en-us/HT207054

But that is not what I am talking about in the article. There I am
speaking of server
or application authentication, and I am arguing that to be secure
this needs two screens
the second screen being what Apple calls the Touch Bar. There is a
video here describing it
https://youtu.be/DhCJuJoE6wM?t=170
But I am sure you'll find many more. (Btw. the new Mac Book Pro is
out today!)

I would guess that parts of the Touch Bar must be OS secured, or
else an app could get your fingerprints? In any case I am saying
that there should be a couple more buttons on the Touch Bar that
are controlled by the OS.
1) the icon of the App that is in the foreground ( which would be
retrieved from the institutional web of trust
2) the icon of the favicon of the web page also retrieved from the
institutional web of trust

clickin those would give you more information about the app in 1)
and more info about the page in 2).
But not just the address of the headquarters, but something a lot
richer.....

Henry

----------------------------------------------------
_______________________________________________
saag mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/saag

--
Michael Richardson <[email-masked]<mailto:[email-masked]>>, Sandelman Software Works
-= IPv6 IoT consulting =-

_______________________________________________
saag mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/saag

_______________________________________________
saag mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/saag

Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.

Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.

---

From: Dmitry Belyavsky <[email-masked]>
Date: Sat, 21 Jul 2018 17:31:02 +0300

Well, it seems possible to confirm that site A is the site A with high
probability.

The main problem is detection that user has visited a site pretending to be
site A and it is necessary to request a confirmation.

сб, 21 июля 2018 г., 15:27 Bret Jordan <[email-masked]>:

> I completely agree.  We need to figure what we can do and specifically how
> we can enable better protection for end users.  Having a completely secure
> and private session is solving just half of the problem.
>
> What do you suggest is the next steps forward?  Clearly we need to do work
> here.  I would love to see some work done here in the IETF to help with
> this.
>
> As you have said attribution is one option. I think it would be good for
> end users to know if they were connecting to a legally legit establishment
> or a crime syndicate fronting an Intrusion Set.
>
> Bret
>
> On Jul 21, 2018, at 4:15 AM, Henry Story <[email-masked]
> <[email-masked]>> wrote:
>
>
>
> Getting back on topic.  I agree this is a significant problem, one that
> needs to be addressed.  While things like LetsEncrypt are great for trying
> to get everyone a cert for free, it also means, Threat Actors and Intrusion
> Sets can get free certs as well.
>
>
> Ben Laurie <benl=[email-masked]
> <benl=[email-masked]>> wrote:
>

---

From: Henry Story <[email-masked]>
Date: Sat, 21 Jul 2018 18:24:42 +0200

> On 21 Jul 2018, at 14:27, Bret Jordan <[email-masked]> wrote:
> 

Well if there were agreement that this Institutional Web of Trust (IWoT)  is missing and
important to security then that would be an important achievement, as it would prepare
the next steps. This is clearly a very large project and there will be many people
involved. (I have added TimBL in CC as he will know many of them). 

Here are the things I can think of, but I am aware I am probably going into too 
much detail,  have some biases that are not explained here, and may be
missing some important strands:

• finding the right players: W3C, IETF, ODI, Repositories, Browser Vendors, State players,
etc... and getting them interested in building this out, and get the buy in for deployment
down the road

• there will have to be some work done to prepare a convincing road map for them
(It would be helpful to find a way to prove the security features of what is being built for example,
initial prototypes, ...)

• map out the size of the project by looking at what the size of the current repositories would
be. Ben Laurie stated that there were 1500 registries in the UK for example. Where is that list?
Are they all relevant? How much data do they have? This may be a web or data science project.
https://twitter.com/BenLaurie/status/1014520767235706880 <https://twitter.com/BenLaurie/status/1014520767235706880>
One does not need to start with all of them, but it would be useful to know where the system
has to grow to so as to make the right decisions upstream.

• finding the ontologists to examining the data structures of the key repositories 
internationally to find the high level ontologies (classes) needed that can grow 
and be extended over time and that will be useful for the browsers to display  
information that will be of interest to the user. [0]
     There are departments dedicated to this in universities around the world. The 
major requirement would be to build it so that it is extensible over time, ie that older
browsers can continue working even as new categories appear, ie it has to be able
to degrade gracefully [1]. 
   It should also be possible for one state to leave warning messages for those that
take it as a trust anchor on companies or sites in its own or other states.
   In the end that work has to be submitted to a process of standardization.

• Load testing: it should be possible to work on some load testing. For example would 
Quic make a big difference to scalability of the project, over and above HTTP2.0? 

• Caching: the point was raised and it is one that the security community is keen on that
the data should be able to come signed from the server one is connected to. In which case
it needs to be signed by the institution in the IWoT that serves it. Ideally the signed document 
could also be dereferenced, so that web sites can start simply by pointing to the institutions in
an http header or the X509 Cert, and when understanding the value optimise the process 
by serving something like what the Verifiable Claims WG is working on, but signed. 
There would then need to be an extension to the HTTP standard for passing the verifiable 
claim through, in addition to the X509 certificate. (I am assuming here that X509 is just going
to be a bit tedious to extend and teach. It would help if the data were the same in the Verifiable
Claim as the one that was served by the institution, so that the graphs are isomorphic)

• Browser Vendors would check out the tools available to help build this efficiently, to
work on elegant and helpful User Interfaces for the data, test it on initial users, give feedback
to ontologies, ...

• I suppose for legal purposes it would be useful if there were ways that all the data served
by institutions like companieshouse.gov.uk or https://www.sec.gov/ <https://www.sec.gov/> were historically versioned
in a verifiable way so that courts could look at what a web user would have seen on a particular
day in order to support or deny a claim. This sounds somewhat blockchainy, though it may not
require anything like global consensus. Signed data dumps per repository may be fine with a way
of verifying this. Given that one needs global hyper-data structures (since we can allow links between
institutions) something like a standard for an RDF based block chain could be very useful here. 
That would make is serialization agnostic, open to new schemas, globally linkable, and formally 
underpinned with logic.) 

Well that's all I can think of right now.
Clearly a lot can be done in parallel: and one can start small and grow the system.
(A bit like https has only recently grown to wide adoption) 

[0] Ontologies are like Class hierarchies in OO programming
   but a declarative version of it that where intermediary relations 
   and classes can  be added, and which are open to various levels 
   of reasoning.

[1] https://www.w3.org/TR/html-design-principles/#degrade-gracefully

> Sent from my Commodore 128D

:D

> On Jul 21, 2018, at 4:15 AM, Henry Story <[email-masked] <mailto:[email-masked]>> wrote:
> 
>> 
>> 
>>> On 20 Jul 2018, at 23:51, Bret Jordan <[email-masked] <mailto:[email-masked]>> wrote:
>>> 
>> [1] https://www.theregister.co.uk/2018/07/03/google_chrome_http/ <https://www.theregister.co.uk/2018/07/03/google_chrome_http/>
>>     https://www.computer.org/csdl/proceedings/sp/2015/6949/00/6949a931-abs.html <https://www.computer.org/csdl/proceedings/sp/2015/6949/00/6949a931-abs.html>

---

From: Brian Witten <[email-masked]>
Date: Sat, 21 Jul 2018 16:33:42 +0000

Hi Josh,

Thanks!  I like your ideas and I agree with very nearly everything you say here.  I “only” disagree with the “only” in your statement that we can “only solve this by x.”  Sure, I agree that x looks like a great approach, but other approaches have also proven effective.  These include reputation based approaches and real-time flagging visuals & text of frequently phished brands, along with server-to-client exploits.  Some of these already block over a billion attacks per year.  Still, I agree wholeheartedly that this is a problem that we the IETF need to solve.  Special thanks to you, Henry, and the others for the attention to the issue.  Thank You Again!

Cheers,
Brian

On Jul 21, 2018, at 7:15 AM, Josh Howlett <[email-masked]<mailto:[email-masked]>> wrote:

From: saag <[email-masked]<mailto:[email-masked]>> On Behalf Of Bret Jordan
Sent: 21 July 2018 13:27
To: Henry Story <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [saag] stopping (https) phishing

Bret

Henry

[1] https://www.theregister.co.uk/2018/07/03/google_chrome_http/<https://clicktime.symantec.com/a/1/ryCMovBBsvNSPeDiq622OlIDONNmjMHmPD_8s4ifMVs=?d=lGgQnnNqCPLybF2TIOd3KYnut3Rg99PPj7JtyLlitrxVSUwo-_mx3ATaIo3jJJcOjBCqg2f46j-yP0e-TICjNjmRMSv6G9LIEILmo-1zB3234YvmbdXAaIwEstK7PMZwRtDBF3_4LsTzx-cYyVTd0bMgAvuBM6jbzrSG6mljjOw5PcBWY7_u1vgXlVqIjdH3dVKVSzg-lGoCQ48Ifef4RQryricawQet1Nq4ZKW-vbAngZH9yAt-Ftu-bGMhUo3GaKMYkHtzC2T3QDDw4cs0EwwblOXeLazLEYbJvmVAgntQ_1JI3mK_6DzU7P5fSpLc2UITl3UcCLYpWBFr9bYWhSxccMvKNB-CL0AcX_Uh88nH44opWwmjxl7kEZmW7mk-mUfg56Cci8WiLLIKQ5PedUF0yxbQnIc9acI%3D&u=https%3A%2F%2Fwww.theregister.co.uk%2F2018%2F07%2F03%2Fgoogle_chrome_http%2F>
[2] The 2015 paper "What is that App? Deceptions and countermeasures
in the Android User Interface"
    https://www.computer.org/csdl/proceedings/sp/2015/6949/00/6949a931-abs.html<https://clicktime.symantec.com/a/1/yObf29wa5Q78quBuhlhdEUAd-4AyeO3L7-YBivj0c44=?d=lGgQnnNqCPLybF2TIOd3KYnut3Rg99PPj7JtyLlitrxVSUwo-_mx3ATaIo3jJJcOjBCqg2f46j-yP0e-TICjNjmRMSv6G9LIEILmo-1zB3234YvmbdXAaIwEstK7PMZwRtDBF3_4LsTzx-cYyVTd0bMgAvuBM6jbzrSG6mljjOw5PcBWY7_u1vgXlVqIjdH3dVKVSzg-lGoCQ48Ifef4RQryricawQet1Nq4ZKW-vbAngZH9yAt-Ftu-bGMhUo3GaKMYkHtzC2T3QDDw4cs0EwwblOXeLazLEYbJvmVAgntQ_1JI3mK_6DzU7P5fSpLc2UITl3UcCLYpWBFr9bYWhSxccMvKNB-CL0AcX_Uh88nH44opWwmjxl7kEZmW7mk-mUfg56Cci8WiLLIKQ5PedUF0yxbQnIc9acI%3D&u=https%3A%2F%2Fwww.computer.org%2Fcsdl%2Fproceedings%2Fsp%2F2015%2F6949%2F00%2F6949a931-abs.html>
I integrated that article in the  "Phishing in Context" post this week.

Thanks,
Bret

Hi,

"Phishing in Context -- Epistemology on the screen"
https://medium.com/@bblfish/phishing-in-context-9c84ca451314<https://clicktime.symantec.com/a/1/gWv2yRUSw5jNiQY4UwmcrwGDlmHfxbUvJqyYGnOFUnA=?d=lGgQnnNqCPLybF2TIOd3KYnut3Rg99PPj7JtyLlitrxVSUwo-_mx3ATaIo3jJJcOjBCqg2f46j-yP0e-TICjNjmRMSv6G9LIEILmo-1zB3234YvmbdXAaIwEstK7PMZwRtDBF3_4LsTzx-cYyVTd0bMgAvuBM6jbzrSG6mljjOw5PcBWY7_u1vgXlVqIjdH3dVKVSzg-lGoCQ48Ifef4RQryricawQet1Nq4ZKW-vbAngZH9yAt-Ftu-bGMhUo3GaKMYkHtzC2T3QDDw4cs0EwwblOXeLazLEYbJvmVAgntQ_1JI3mK_6DzU7P5fSpLc2UITl3UcCLYpWBFr9bYWhSxccMvKNB-CL0AcX_Uh88nH44opWwmjxl7kEZmW7mk-mUfg56Cci8WiLLIKQ5PedUF0yxbQnIc9acI%3D&u=https%3A%2F%2Fmedium.com%2F%40bblfish%2Fphishing-in-context-9c84ca451314>

Do you mean what they describe on wikipedia here ?
https://en.wikipedia.org/wiki/Secure_attention_key<https://clicktime.symantec.com/a/1/SM1G1BbBI-FwMHBWlufGAqGwXnFCypDn3Y8YcDJUcx4=?d=lGgQnnNqCPLybF2TIOd3KYnut3Rg99PPj7JtyLlitrxVSUwo-_mx3ATaIo3jJJcOjBCqg2f46j-yP0e-TICjNjmRMSv6G9LIEILmo-1zB3234YvmbdXAaIwEstK7PMZwRtDBF3_4LsTzx-cYyVTd0bMgAvuBM6jbzrSG6mljjOw5PcBWY7_u1vgXlVqIjdH3dVKVSzg-lGoCQ48Ifef4RQryricawQet1Nq4ZKW-vbAngZH9yAt-Ftu-bGMhUo3GaKMYkHtzC2T3QDDw4cs0EwwblOXeLazLEYbJvmVAgntQ_1JI3mK_6DzU7P5fSpLc2UITl3UcCLYpWBFr9bYWhSxccMvKNB-CL0AcX_Uh88nH44opWwmjxl7kEZmW7mk-mUfg56Cci8WiLLIKQ5PedUF0yxbQnIc9acI%3D&u=https%3A%2F%2Fen.wikipedia.org%2Fwiki%2FSecure_attention_key>

That would be to authenticate the user of the computer, which is I
suppose a
predecessor of what the fingerprint button on new MacBook Pro
laptops is about
(I don't know, as I don't have them). They call it Touch Id
https://support.apple.com/en-us/HT207054<https://clicktime.symantec.com/a/1/L92qCmg1N4evk6I8wjVids2yRuNuvuEZ2ZbK0xTMvcM=?d=lGgQnnNqCPLybF2TIOd3KYnut3Rg99PPj7JtyLlitrxVSUwo-_mx3ATaIo3jJJcOjBCqg2f46j-yP0e-TICjNjmRMSv6G9LIEILmo-1zB3234YvmbdXAaIwEstK7PMZwRtDBF3_4LsTzx-cYyVTd0bMgAvuBM6jbzrSG6mljjOw5PcBWY7_u1vgXlVqIjdH3dVKVSzg-lGoCQ48Ifef4RQryricawQet1Nq4ZKW-vbAngZH9yAt-Ftu-bGMhUo3GaKMYkHtzC2T3QDDw4cs0EwwblOXeLazLEYbJvmVAgntQ_1JI3mK_6DzU7P5fSpLc2UITl3UcCLYpWBFr9bYWhSxccMvKNB-CL0AcX_Uh88nH44opWwmjxl7kEZmW7mk-mUfg56Cci8WiLLIKQ5PedUF0yxbQnIc9acI%3D&u=https%3A%2F%2Fsupport.apple.com%2Fen-us%2FHT207054>

https://youtu.be/DhCJuJoE6wM?t=170<https://clicktime.symantec.com/a/1/ZYbMf7WcV2kJ_ItK5AKwcTcxjAfLJZbNeoL-LBT0u-4=?d=lGgQnnNqCPLybF2TIOd3KYnut3Rg99PPj7JtyLlitrxVSUwo-_mx3ATaIo3jJJcOjBCqg2f46j-yP0e-TICjNjmRMSv6G9LIEILmo-1zB3234YvmbdXAaIwEstK7PMZwRtDBF3_4LsTzx-cYyVTd0bMgAvuBM6jbzrSG6mljjOw5PcBWY7_u1vgXlVqIjdH3dVKVSzg-lGoCQ48Ifef4RQryricawQet1Nq4ZKW-vbAngZH9yAt-Ftu-bGMhUo3GaKMYkHtzC2T3QDDw4cs0EwwblOXeLazLEYbJvmVAgntQ_1JI3mK_6DzU7P5fSpLc2UITl3UcCLYpWBFr9bYWhSxccMvKNB-CL0AcX_Uh88nH44opWwmjxl7kEZmW7mk-mUfg56Cci8WiLLIKQ5PedUF0yxbQnIc9acI%3D&u=https%3A%2F%2Fyoutu.be%2FDhCJuJoE6wM%3Ft%3D170>

Henry

----------------------------------------------------
_______________________________________________
saag mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/saag<https://clicktime.symantec.com/a/1/4oDbbl0uisyRZ3t0zwBtDRkWN6VaHyZWovLGMSEl6hg=?d=lGgQnnNqCPLybF2TIOd3KYnut3Rg99PPj7JtyLlitrxVSUwo-_mx3ATaIo3jJJcOjBCqg2f46j-yP0e-TICjNjmRMSv6G9LIEILmo-1zB3234YvmbdXAaIwEstK7PMZwRtDBF3_4LsTzx-cYyVTd0bMgAvuBM6jbzrSG6mljjOw5PcBWY7_u1vgXlVqIjdH3dVKVSzg-lGoCQ48Ifef4RQryricawQet1Nq4ZKW-vbAngZH9yAt-Ftu-bGMhUo3GaKMYkHtzC2T3QDDw4cs0EwwblOXeLazLEYbJvmVAgntQ_1JI3mK_6DzU7P5fSpLc2UITl3UcCLYpWBFr9bYWhSxccMvKNB-CL0AcX_Uh88nH44opWwmjxl7kEZmW7mk-mUfg56Cci8WiLLIKQ5PedUF0yxbQnIc9acI%3D&u=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fsaag>

_______________________________________________
saag mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/saag<https://clicktime.symantec.com/a/1/4oDbbl0uisyRZ3t0zwBtDRkWN6VaHyZWovLGMSEl6hg=?d=lGgQnnNqCPLybF2TIOd3KYnut3Rg99PPj7JtyLlitrxVSUwo-_mx3ATaIo3jJJcOjBCqg2f46j-yP0e-TICjNjmRMSv6G9LIEILmo-1zB3234YvmbdXAaIwEstK7PMZwRtDBF3_4LsTzx-cYyVTd0bMgAvuBM6jbzrSG6mljjOw5PcBWY7_u1vgXlVqIjdH3dVKVSzg-lGoCQ48Ifef4RQryricawQet1Nq4ZKW-vbAngZH9yAt-Ftu-bGMhUo3GaKMYkHtzC2T3QDDw4cs0EwwblOXeLazLEYbJvmVAgntQ_1JI3mK_6DzU7P5fSpLc2UITl3UcCLYpWBFr9bYWhSxccMvKNB-CL0AcX_Uh88nH44opWwmjxl7kEZmW7mk-mUfg56Cci8WiLLIKQ5PedUF0yxbQnIc9acI%3D&u=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fsaag>

_______________________________________________
saag mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/saag<https://clicktime.symantec.com/a/1/4oDbbl0uisyRZ3t0zwBtDRkWN6VaHyZWovLGMSEl6hg=?d=lGgQnnNqCPLybF2TIOd3KYnut3Rg99PPj7JtyLlitrxVSUwo-_mx3ATaIo3jJJcOjBCqg2f46j-yP0e-TICjNjmRMSv6G9LIEILmo-1zB3234YvmbdXAaIwEstK7PMZwRtDBF3_4LsTzx-cYyVTd0bMgAvuBM6jbzrSG6mljjOw5PcBWY7_u1vgXlVqIjdH3dVKVSzg-lGoCQ48Ifef4RQryricawQet1Nq4ZKW-vbAngZH9yAt-Ftu-bGMhUo3GaKMYkHtzC2T3QDDw4cs0EwwblOXeLazLEYbJvmVAgntQ_1JI3mK_6DzU7P5fSpLc2UITl3UcCLYpWBFr9bYWhSxccMvKNB-CL0AcX_Uh88nH44opWwmjxl7kEZmW7mk-mUfg56Cci8WiLLIKQ5PedUF0yxbQnIc9acI%3D&u=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fsaag>

Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.
_______________________________________________
saag mailing list
[email-masked]<mailto:[email-masked]>
https://clicktime.symantec.com/a/1/T9vdF8RXa3uzVEC8esBHjuQGUiggrfurix1xfHG5E3w=?d=NPtX3Bxfc5tdVTXXm3qXErGIeHIA2Q_ooYDbsOo0RTTFOGRX_K6yrHk0C49QbfYT8oYbEG4pku6bEiqmZviAE_JPKb5p6bR7Z2fuyeIj1PT5RHwoWykYjfIvjHnwaMzjGc2p-5Yu3_8psNB6H3q-cyAzix18VRNx1QlQ8Q4B4mCQNyap2U1zoPGObiIF1ycI-FGix-4SwlLZJxR4neEGWpQIUaRVHkfj7rnTN49i7gK_Nwcv1jqmwG4QQanpuu2xg3cG-NOEgHN68YnPKa0P0-QR2F42gEnj3BDzSxXYTp6bVn-uyKjiyDZrLTWfGSXcD4d1XNypqGp5Gpq1d9QZ9r-3oVNITJl4VZs_WTwNkG7UoaHe_FfiiBWUqaVxmgSmjtAUAx91jlQYBPXlv8HkpYMc6CY_HO6-4mk%3D&u=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fsaag

---

From: "John R. Levine" <[email-masked]>
Date: 21 Jul 2018 13:12:31 -0400

On Sat, 21 Jul 2018, Henry Story wrote:
> important to security then that would be an important achievement, ...

How would this IWoT differ from what CAs were supposed to do?  When I got 
my first SSL certificate 20 years ago, I had multiple phone calls and 
faxes with the CA to establish that I was who I purported to be.  That was 
then, now DV CAs verify nothing, and EV certs, which sort of do what DV 
certs used to do, are also briskly racing to the bottom.

I would also consider the impressive non-success of the PGP web of trust 
outside tiny niches of people who know each other anyway.

This does not sound like a good idea to me.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. https://jl.ly

---

From: Henry Story <[email-masked]>
Date: Sat, 21 Jul 2018 20:27:40 +0200

> On 21 Jul 2018, at 19:12, John R. Levine <[email-masked]> wrote:
> 
> How would this IWoT differ from what CAs were supposed to do?  

That is easy. IWoT would be based on institutions that tie into nation or region based local 
registries that tie into national anchors that may tie into federal ones (as in the USA, or Germany).
We are trying to get the national legal registries system to publish
in open data what  they already have about the companies, bakeries, hospitals,
schools, universities, etc in a decentralised way so that we don't need to specify the 
topology of these registries in advance. This data would be published on the web,
so it can be used by browsers to give rich information to the user about the company 
whose home page they are landing on.

(
So because thinking in terms of digital sovereignty is unusual for computer scientists
I wrote up a perhaps too lengthy post that goes into the debate at the political level
that is going on there, by linking to laws the French parliament passed a few years ago, 
a book that was published on the subject, an interview by a constitutional lawyer, 
the relation to Brexit and how this can tie back to the Web.

From Digital Sovereignty to the Web of Nations
https://medium.com/cybersoton/from-digital-sovereignty-to-the-web-of-nations-61fbc28d79cd <https://medium.com/cybersoton/from-digital-sovereignty-to-the-web-of-nations-61fbc28d79cd>
)

Now CAs are very different. A CA only certifies a few attributes of the owner of the web site, 
and only a minute part of the information published on the web by a registry such as
beta.companyhouse.gov.uk <http://beta.companyhouse.gov.uk/>

In the article on "Stopping (https) Phishing"
https://medium.com/cybersoton/stopping-https-phishing-42226ca9e7d9 <https://medium.com/cybersoton/stopping-https-phishing-42226ca9e7d9>

 there is a curl example showing JSON data published from the api.companyhouse.gov.uk <http://api.beta.companyhouse.gov.uk/>
version of the beta web site. Then I show how a web site could link to such a document which could link back,
how a browser could follow links to get to the root authority,  always verifying that the page it landed on linked
back to the original site it just came from. This creates a link based, https protected, verification
chain. This chain would mostly be hierarchical up to the national level, and then peer to peer
between nations, though without a requirement that all nations link to each other. Because this
is web based it is quite easy to set and change information or links, so that the data can be
much more fluid and rich than what X509 certificates can give. 

X509 CA's can certify web sites for companies of any nationality. The proposal works with 
nations that are restricted to certify web sites for their institutions, binding those to their legal 
and diplomatic systems. 

> When I got my first SSL certificate 20 years ago, I had multiple phone calls and faxes with the CA to establish that I was who I purported to be.  That was then, now DV CAs verify nothing, and EV certs, which sort of do what DV certs used to do, are also briskly racing to the bottom.

Well here it is the country that would be responsible for collecting taxes that is tied to your identity.
There is a lot of value for them to track you correctly, and there should be legal systems in place for 
you to be able to defend yourself against abuse, but also for people to seek redress in case your 
company  breaks the law. All this already exists. It could just be made explicit so that browsers can
tie into them.

> I would also consider the impressive non-success of the PGP web of trust outside tiny niches of people who know each other anyway.

Yes I also write a short post 
"Why did the Web of Trust fail?"
In response to a similar question by Prof Bryan Ford of EPFL 
https://medium.com/@bblfish/what-are-the-failings-of-pgp-web-of-trust-958e1f62e5b7 <https://medium.com/@bblfish/what-are-the-failings-of-pgp-web-of-trust-958e1f62e5b7>

I argue there that the person 2 person PGP web of trust failed because people are not necessarily
good at verifying properties. I may be good at verifying anyone's name, but that does not mean that those
I verify are good at it. So the links cannot go very far. And that is just for names. Clearly nobody is going 
to argue that anyone would be good at verifying driving ability. There are institutions designed to do that 
such as the DMV and the driving training schools.

> This does not sound like a good idea to me.

yes, the PGP web of trust was a good way to get a lot of people to think about cryptography. 
But as it's only way of linking two people was signing and there are only 2 attributes in PGP
(name/e-mail and photo) and there are only 8bits of attributes available, it is quite limited.

Since then we have a whole slew of tools have been standardized for working with data 
globally and so potentially inconsistently, which following hyper-text we should call hyper-data. 
These  that have been developed over the past 20 years, which allow very rich data structures 
that can evolve, for which there are logical formalisms  and that are designed for the web - ie 
for linkability across organizations and nations. This allows one to cleanly separate the data and 
the security layer which can just use https. One can then add signatures too, but the fact that 
one does not need to helps make clear that these are orthogonal problems.

But it is also because these are orthogonal (data, api, security, UI) that the communities rarely meet.
It is time to link them :-)

---

From: "John R. Levine" <[email-masked]>
Date: 21 Jul 2018 14:40:01 -0400

> registries that tie into national anchors that may tie into federal ones (as in the USA, or Germany).

This sounds a lot like the industry-specific CAs I proposed, only this 
depends on a great deal of software that does not exist and probably never 
will.

R's,
John

---

From: Henry Story <[email-masked]>
Date: Sat, 21 Jul 2018 21:21:12 +0200

> On 21 Jul 2018, at 20:40, John R. Levine <[email-masked]> wrote:
> 
> This sounds a lot like the industry-specific CAs I proposed, only this depends on a great deal of software that does not exist and probably never will.

It would be interesting to look in more details at your proposal for industry specific CAs to contrast 
and compare the proposal I made. 

Here the idea is to cover all industries across all nations, fora world wide web of institutional trust.  
If your proposal is based on X509 then you have the problem of having a format that is too rigid I think
as far as attribute extensibility goes. Also if it is only based on certificates, then you limit yourself to 
a very limited set of attributes, unless you update certificates every day. Both of those two limitations 
together add up to something that is somewhat brittle and inflexible. 

As far as "software that does not exist..." , well it's has all been developed over the past 20 years or so.

• The Open Data Institute and other such organizations have been getting governments to start publishing their data
   see the beta.companieshouse.gov.uk <http://beta.companieshouse.gov.uk/> for example
• hyperdata has been standardized at the W3C and widely tested with projects around the world. There
is a depiction at http://lod-cloud.net/ <http://lod-cloud.net/>
• There is a JSON-LD format to interoperate nicely with JSON folks
• there are many open source implementations of the standards in many different languages including of course
JS. There are competitions for large scale databases, though this is not needed here. Small quad
stores would do fine.
• Universities have been forming people at this for years, and there are numerous Phds, companies, etc. on the ball

As I said because at one level it is orthogonal to security it is not surprising if the security community encountered
this at the periphery. Just the same is true on their side. (Though there have been quite a few papers on access control
reasoning systems too in linked data communities)...

The proposal may not be incompatible with CAs or X509 either btw. The proposal is to start
off getting government registries to publish data that can be used openly by browsers to 
increase security. Nothing excludes yet CAs to play an important new role here.

I am happy to look at papers that cover similar topics to compare and contrast.

Henry

---

From: Bret Jordan <[email-masked]>
Date: Sat, 21 Jul 2018 19:30:34 -0400

The key is to keep working on this, discussing ideas, working through options.   

I for one would really like to see the IETF setup a working group for this specific topic, it would be good to work through this and find a solution that works. I would be willing to help out here and will dedicate time to this effort. 

Bret 

> On Jul 21, 2018, at 2:40 PM, John R. Levine <[email-masked]> wrote:
>

---

From: "John R. Levine" <[email-masked]>
Date: 21 Jul 2018 21:00:55 -0400

> I for one would really like to see the IETF setup a working group for this specific topic, it would be good to work through this and find a solution that works. I would be willing to help out here…

I don't think there is enough stuff here to merit WG.  Perhaps talk to the 
IRTF about an RG to explore ideas not ready to standardize.

Regards,

---

From: Henry Story <[email-masked]>
Date: Sun, 22 Jul 2018 10:45:11 +0200

> On 21 Jul 2018, at 21:27, John R. Levine <[email-masked]> wrote:
> 
> It was on this list a week ago.

Can you please give a link to the document. That would help. I searched the archive for posts
by you on your two e-mail addresses on https://mailarchive.ietf.org/arch/browse/saag/ <https://mailarchive.ietf.org/arch/browse/saag/> 

> Sounds like software that does not exist to me.  Write back in a decade and let us know how it's coming along.

Ah I understand [1]! 

So what does exist is:
– https web servers servers
– at least one open data server with a RESTful API publishing data for public companies for the whole UK
  and a list of other online repositories some of which may also do this
   https://www.gov.uk/government/publications/overseas-registries/overseas-registries
– web browsers
– JSON and RDF Parers and libraries

What is missing is code implementing the proof procedure I describe I the article
with the name of this thread [2], and potentially a proof for why this would be good
enough of a proof. 

I could implement a Firefox plugin that showed a button that changed color to green 
say if there a proven chain to the trust authority, and on clicking that would open
the info page about the company whose web site the user was looking at. 

The proof for why this is a proof (even though in a way it is obvious that it is) is something
I am working on for my PhD. That requires I think a mathematical representation of the web.

Is that the kind of software you would be looking for?

Henry

[1]  For reasons similar to those in the Muddy Children's Puzzle [1] where just by someone
asking a question the answer can be revealed
http://sierra.nmsu.edu/morandi/CourseMaterials/MuddyChildren.html
[2] https://medium.com/cybersoton/stopping-https-phishing-42226ca9e7d9 <https://medium.com/cybersoton/stopping-https-phishing-42226ca9e7d9>

---

From: Adam Montville <[email-masked]>
Date: Sun, 22 Jul 2018 07:04:55 -0500

Whether a WG or an RG, I’d be interested in helping here.

On Jul 21, 2018, at 8:00 PM, John R. Levine <[email-masked]> wrote:

> I don't think there is enough stuff here to merit WG.  Perhaps talk to the IRTF about an RG to explore ideas not ready to standardize.
> 
> 
>> 
>> Bret
>>

---

From: Alan DeKok <[email-masked]>
Date: Sun, 22 Jul 2018 09:49:26 -0400

On Jul 21, 2018, at 10:31 AM, Dmitry Belyavsky <[email-masked]> wrote:
> 
> Well, it seems possible to confirm that site A is the site A with high probability.

  What are the properties that make it continue to be "site A" ?

  So far as I can see, the only property that the user can trust is "it's the same site as I visited last time".  But what does that mean?

  Companies move.  Domains expire and get re-bought.  Certificates expire.  Systems change.

  That means the "same" site may have all public information about it change in between visits.  Not a good practice for continued identification.

> The main problem is detection that user has visited a site pretending to be site A and it is necessary to request a confirmation. 

  There are an infinite number of "bad" sites, and only one "good" site.  That tells me you should ignore the problem of detecting "bad" sites.  Because to first order "It's bad" is correct for 99.999...% of the sites out there.

  A big cause of phishing is that each end point doesn't retain much information about the other.  So for *every* connection, each end point has to ask "is the other end real?" 

  Perhaps making that decision fewer times would be a better solution.

  A better solution would be to check "is this the same site as last time?"  That seems to be a much simpler problem to solve.  i.e. presume that the initial connection can be done correctly (as is mostly done today).  Then, leverage that connection to have stronger identity checks for subsequent connections.

  Alan DeKok.

---

From: Christian Huitema <[email-masked]>
Date: Sun, 22 Jul 2018 16:04:44 +0200

> On Jul 22, 2018, at 3:49 PM, Alan DeKok <[email-masked]> wrote:
> 

The problem is the disconnect between the user intent and the hyperlink. Based on the context, the user believes that she is checking her account at "bank of example", but the hyperlink points to something different. If only the system could understand what the user is thinking. It might then throw a warning, or better still just connect to the actual "bankofexample.com".

But of course, understanding the context and guessing what the user thinks seems really hard...

-- Christian Huitema

---

From: Dmitry Belyavsky <[email-masked]>
Date: Sun, 22 Jul 2018 17:11:43 +0300

вс, 22 июля 2018 г., 16:49 Alan DeKok <[email-masked]>:

>   So far as I can see, the only property that the user can trust is "it's
> the same site as I visited last time".  But what does that mean?
>

Yes, but this does not cover all the cases. I may want to visit a e.g. new
online shop I have never seen before.

>   That means the "same" site may have all public information about it
> change in between visits.  Not a good practice for continued identification.
>

Yes. So we come to idea of long-term identity independent from all these
changes.

> > The main problem is detection that user has visited a site pretending to
> be site A and it is necessary to request a confirmation.
>
>   There are an infinite number of "bad" sites, and only one "good" site.
> That tells me you should ignore the problem of detecting "bad" sites.
> Because to first order "It's bad" is correct for 99.999...% of the sites
> out there.
>

Yes. But if I visit PayPal I need to know it's PayPal, not Facebook.

>   A big cause of phishing is that each end point doesn't retain much
> information about the other.  So for *every* connection, each end point has
> to ask "is the other end real?"
>
>   A better solution would be to check "is this the same site as last
> time?"  That seems to be a much simpler problem to solve.  i.e. presume
> that the initial connection can be done correctly (as is mostly done
> today).  Then, leverage that connection to have stronger identity checks
> for subsequent connections.
>
>   Alan DeKok.
>
>

---

From: Bret Jordan <[email-masked]>
Date: Sun, 22 Jul 2018 08:13:22 -0600

Talking to the IRTF is an option. It just feels like once we allocate people and resources to this problem it is going to need a WG, then as we go along and discover the rest of the ice berg, it may need to even grow bigger than that. 

Bret

---

From: Alan DeKok <[email-masked]>
Date: Sun, 22 Jul 2018 10:31:11 -0400

On Jul 22, 2018, at 10:11 AM, Dmitry Belyavsky <[email-masked]> wrote:
> 
> Yes, but this does not cover all the cases. I may want to visit a e.g. new online shop I have never seen before. 

  I am well aware of that.

  My point is that the current system works.  Not perfectly.  But it mostly works.

  Any solution which involves many parties (national registries, etc.) is bound to fail.  Changing their behaviour involves political and legal procedures.  Which makes the IETF look lightning fast.

> Yes. So we come to idea of long-term identity independent from all these changes. 

  My $0.02 is that the only two parties who care about their identities are the site, and the user.  A solution which involves just them is likely to work.  And, be deployed *much* more quickly than a system which involves national registries.

> Yes. But if I visit PayPal I need to know it's PayPal, not Facebook. 

  You know today that it's Paypal.  Mostly.  Imperfectly.  But the billions of people who get online every day show that the system works reasonable well

  My point (which I think was missed) is that you don't need to do in-depth validations for every connection.  You just need to do them on the initial connection.  Subsequent connections can  leverage cached information to gain additional security.

  This is how the real world works.  When I meet someone new, I remember their physical attributes (face, voice, mannerisms).  I use that information in subsequent interactions.

  Re-introducing yourself for every interaction is inefficient, and is likely to have new failure modes.

  Alan DeKok.

---

From: Bret Jordan <[email-masked]>
Date: Sun, 22 Jul 2018 08:33:50 -0600

This is all great discussion and I believe it indicated that we should do more work here. Getting a WG going that is focused on this sort of problem can really help drive things forward.  Initially there might just be a lot of informational drafts, but longer term I could see us publishing a whole series of standards.

Bret 

> On Jul 22, 2018, at 8:11 AM, Dmitry Belyavsky <[email-masked]> wrote:
> 
> 
>

---

From: Alan DeKok <[email-masked]>
Date: Sun, 22 Jul 2018 10:46:57 -0400

On Jul 22, 2018, at 10:04 AM, Christian Huitema <[email-masked]> wrote:
> 
> The problem is the disconnect between the user intent and the hyperlink. Based on the context, the user believes that she is checking her account at "bank of example", but the hyperlink points to something different.

  Such as when the bank changes the domain name it uses?

  And why are you relying on hyperlinks for the second to N connections to the bank?

  e.g. some systems use downloadable apps.  The user doesn't trust hyperlinks.  The user trusts the app residing on his desktop.  Which he controls.

  When the user clicks on a hyperlink, the site could cause the downloaded app to open.  Which (again) is done today in many situations.

  The user then knows "no app == not the real bank".

  I'm not proposing this as a solution.  But you could see how it would solve a large part of the problem space.

> If only the system could understand what the user is thinking. It might then throw a warning, or better still just connect to the actual "bankofexample.com".
> 

  Which is why I wasn't suggesting that.

  I think there are solutions.  But those solutions likely involve changing the way we think about the problem.

  i.e. "detecting bad sites" is hard.  Knowing it's the "same site" is easy.

  Why not solve the easy problem?

  Alan DeKok.

---

From: Henry Story <[email-masked]>
Date: Sun, 22 Jul 2018 17:47:05 +0200

> On 22 Jul 2018, at 16:31, Alan DeKok <[email-masked]> wrote:
> 

yes, the current system was designed to give the web and the internet time to grow to the point where it
would start becoming evident to the political systems that it is an essential piece of infrastracture
that cannot be ignored. The recent elections in the UK, the USA and other places have made
that point. Not a day goes by without these issues being discussed on the news, in television,
by the President of the USA himself under the theme of "fake news". 

So now we had better build the right system before the politicians make laws that make the situation
worse than better. Having a clean plan that respects national sovereignties would at least allow
one to redirect political energies towards something constructive in which the nations can
feel they have their place.

While this work goes on the current system will continue functioning with various improvements
that people are already working on. Complete deployment of DANE and DNS-Sec for
example, IPV-6, and other projects that I don't know about....

> My $0.02 is that the only two parties who care about their identities are the site, and the user.  A solution which involves just them is likely to work.  And, be deployed *much* more quickly than…

Perhaps solving both problems is not incompatible and can work together. Always something to consider.

> Re-introducing yourself for every interaction is inefficient, and is likely to have new failure modes.

Actually there is something to that in the IWoT proposal I put forward in the UI side. The full information
UI would only be shown on first visit, or if there was an important company change, or warning information
from the government with respect to that site.

Henry Story

---

From: Michael Richardson <[email-masked]>
Date: Sun, 22 Jul 2018 16:18:47 -0400

> feel they have their place.

I think that you make a very good point.
I agree strongly: that the national entities need to have somewhere
to put their energies.

But, in particular that point makes it out probably not IETF's job.
Rather, it's for W3C, browser makers and specifically, I think it's called
WebPKI, but google isn't finding the entity I think that I want.

Having said that, there is value for what Alan suggested: familiarity should
be re-inforced.... but initial contact continues to be a problem.

---

From: Roland Zink <[email-masked]>
Date: Mon, 23 Jul 2018 01:17:57 +0200

Am 22.07.2018 um 17:47 schrieb Henry Story:
>
>
>> On 22 Jul 2018, at 16:31, Alan DeKok <[email-masked] 
>> <mailto:[email-masked]>> wrote:
>>
>> On Jul 22, 2018, at 10:11 AM, Dmitry Belyavsky <[email-masked] 
>> <mailto:[email-masked]>> wrote:
>>>
>>> Yes, but this does not cover all the cases. I may want to visit a 
>>> e.g. new online shop I have never seen before.
>>
>> I am well aware of that.
>>
>> Any solution which involves many parties (national registries, etc.) 
>> is bound to fail.  Changing their behaviour involves political and 
>> legal procedures.  Which makes the IETF look lightning fast.
>
>> My $0.02 is that the only two parties who care about their identities 
>> are the site, and the user.  A solution which involves just them is 
>> likely to work.  And, be deployed *much* more quickly than a system 
>> which involves national registries.
>

My $0.02 is that the user probably care about a site identity but 
doesn't get information about all involved parties. Although in the web 
browser one party is displayed in reality the page is composed and 
hosted on potential many sites. Especially the site hosting may be 
delegated to a third party and the access information sold for example 
into the adverts industry. What is missing is that the user is able to 
delegate some of its security concerns to a third party acting on his 
behalf. I don't see why this needs to be in the browser or 
institutional. Currently the virus scanning industry has such a business 
model.

>> You know today that it's Paypal.  Mostly.  Imperfectly.  But the 
>> billions of people who get online every day show that the system 
>> works reasonable well
>>
>> My point (which I think was missed) is that you don't need to do 
>> in-depth validations for every connection. You just need to do them 
>> on the initial connection.  Subsequent connections can  leverage 
>> cached information to gain additional security.
>>
>> This is how the real world works.  When I meet someone new, I 
>> remember their physical attributes (face, voice, mannerisms).  I use 
>> that information in subsequent interactions.
>>
There are many aspects of the many servers involved in handling the 
requests for a page or application. In many cases users will not be 
interested in the full information and when you don't know which ones 
are the interesting ones, for example into which countries the requests 
are logged.

---

From: Henry Story <[email-masked]>
Date: Mon, 23 Jul 2018 10:30:56 +0200

> On 22 Jul 2018, at 22:18, Michael Richardson <[email-masked]> wrote:
> 

It's a big project and there will be parts that clearly seem best done at W3C,
such as the development of the ontologies, for which they have a lot of expertise.

Not everything going on at W3C is browser related btw. Well only in the very large
sense that all applications on the OS are going to be browsers of hyper-data on
a read-write web. 

In the article below I argue why control of open hardware, inspectability of OS, 
open standards, data, are the only way for us to be able to know. But also 
and as a weird shadow  phenomenon knowledge also requires access control,  
privacy, identity and security.

"Epistemology in the Cloud - on Fake News and digital Sovereignty"
https://bblfish.net/blog/2018/04/21/ <https://bblfish.net/blog/2018/04/21/>

The difficulty is that all the open requirements of the architecture are seemingly 
in contradiction to the protection part. We have a yin/yang duality of concepts that
come together. This means that groups focusing on open 
data tend to not think about security. And those thinking about security tend to 
only want point 2 point communication and not have anything to do with the rest 
of the social space in which we interact. One side is too open, the other side too 
closed. One side is too trusting, the other side paranoid by profession.

So perhaps because the SAAG is used to high level security discussions
this thought has caught on here much better than in some other forums,
and more easily that on W3C security forums, where the browser as the first
hyperdata application, have an overwhelming presence and sometimes forget
the bigger picture of hyper apps.

> be re-inforced.... but initial contact continues to be a problem.

Btw, is it just me, or could we say that IETF is mostly concentrated on protocols
(DNS, HTTP, IPV6, TLS, TCP,...)
where W3C is mostly concentrated on data structures (HTML, CSS, XML, RDF, ... ).

Now in category theory data structures fall in the algebraic side, and protocols fall in
the co-algebraic side of things. These are the same categories with the arrows turned
around! [0]

•  Data Structures such as an RDF graph have clear identity relations. They can be added
 together g1 + g2 = g3 , as numbers can eg 1+2=3. These are algebraic constructs. You
start out with something you know, and you end up with something completely determined 
by the input to the function.

• On the other co-algebras is the space of (infinite) streams, of processes, object oriented programming [1],
and I guess protocols. Here you start off with states, that you don't know much about and you need
to inspect them. The equivalent of equational reasoning in algebras  in co-algebras is modal reasoning: 
one reasons about the next state, or all future next steps (all states have a certain property, or one 
future state could have that property).

There is a concept of bialgebras which work with both. And I guess that is where the web as
protocol plus data is located. So mathematically it may just be that the IETF and W3C are
inseparable ;-)

Henry

[0] https://scholar.google.co.uk/scholar?cluster=678090575657123815&hl=en&as_sdt=0,5
[1] https://www.quora.com/Why-is-functional-programming-seen-as-the-opposite-of-OOP-rather-than-an-addition-to-it/answer/Henry-Story

---

From: Henry Story <[email-masked]>
Date: Mon, 23 Jul 2018 12:25:17 +0200

> On 23 Jul 2018, at 01:17, Roland Zink <[email-masked] <mailto:[email-masked]>> wrote:
> 
>>> On 22 Jul 2018, at 16:31, Alan DeKok <[email-masked] <mailto:[email-masked]>> wrote:
>>> 
>>> On Jul 22, 2018, at 10:11 AM, Dmitry Belyavsky <[email-masked] <mailto:[email-masked]>> wrote:
>>>> 
> My $0.02 is that the user probably care about a site identity but doesn't get information about all involved parties. Although in the web browser one party is displayed in reality the page is composed and hosted on potential many sites.

This will be even more true in a world of hyper-apps, where one application fetches data from many different
sites by following links,  has to be the case if we are going to respect individual and company autonomy, national
sovereignties.  ( see https://bblfish.net/blog/2018/04/21/ <https://bblfish.net/blog/2018/04/21/> ) 

An application that shows information from many sites should be able to give information when requested about
each place it got it from, but clearly soon many decisions will be automated for the convenience of the user.
Still it should always be possible to help the user understand why a certain decision was taken and how it relates
to his automation preferences. Indeed it should be transparent, so that in case this reaches a court, all the information
that lead to a representation being shown can be placed in front of a judge and jury.

> Especially the site hosting may be delegated to a third party and the access information sold for example into the adverts industry. What is missing is that the user is able to delegate some of its security concerns to a third party acting on his behalf. I don't see why this needs to be in the browser or institutional. Currently the virus scanning industry has such a business model.

The institutional web of trust is there to delegate descriptions of companies. Not to make further trust decisions, which
may completely depend on each individual actor. After all, not every company in a country trusts the other. Many are in very rivalrous competition. The IWoT only gives the official information about institutions, which is a lot more than what we have right now.

Henry

> There are many aspects of the many servers involved in handling the requests for a page or application. In many cases users will not be interested in the full information and when you don't know which ones are the interesting ones, for example into which countries the requests are logged.
> 
>> Henry Story
>> 
>>> 
>>> Alan DeKok.
>>>

---

From: Tim Hollebeek <[email-masked]>
Date: Mon, 23 Jul 2018 15:55:46 +0000

I'd help, too.  This is an important problem.  I think I would favor a RG because
I haven't seen any ideas proposed yet that would have a significant impact on
the problem, though some people seem to be thinking along the right directions.
It's a tough problem.

-Tim

> From: saag <[email-masked]> On Behalf Of Adam Montville
> Sent: Sunday, July 22, 2018 8:05 AM
> To: John R. Levine <[email-masked]>
> Cc: [email-masked]
> >> I for one would really like to see the IETF setup a working group for this
> specific topic, it would be good to work through this and find a solution that
> works. I would be willing to help out here and will dedicate time to this effort.
> >
> > I don't think there is enough stuff here to merit WG.  Perhaps talk to the IRTF
> about an RG to explore ideas not ready to standardize.
> >
> >
> >>
> >> Bret
> >>
> >>>> That is easy. IWoT would be based on institutions that tie into
> >>>> nation or region based local registries that tie into national anchors that
> may tie into federal ones (as in the USA, or Germany).
> >>>
> > John Levine, [email-masked], Primary Perpetrator of "The Internet for
> > Dummies", Please consider the environment before reading this e-mail.
> > https://jl.ly
> >

---

From: Nalini J Elkins <[email-masked]>
Date: Mon, 23 Jul 2018 16:09:02 +0000 (UTC)

I am willing to help also.

This is an important problem for enterprises.  You may be familiar with the OPM data breach which was most likely started by a phishing attack.

https://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach

I wonder if we want to have some type of meeting in Bangkok.
Thanks,

Nalini Elkins
CEO and Founder
Inside Products, Inc.
www.insidethestack.com
(831) 659-8360

________________________________
From: Tim Hollebeek <[email-masked]>
To: Adam Montville <[email-masked]>; John R. Levine <[email-masked]> 
Cc: "[email-masked]" <[email-masked]>
Sent: Monday, July 23, 2018 8:56 AM
Subject: Re: [saag] stopping (https) phishing

-Tim

---

From: Benjamin Kaduk <[email-masked]>
Date: Mon, 23 Jul 2018 11:16:50 -0500

> Yes. So we come to idea of long-term identity independent from all these

This calls to mind the "TLS Identity Ticket" proposal that was brought to
TLS and secdispatch several IETF meetings ago.  I'm curious how it compares
to what you're thinking of, and what you think it lacks in terms of getting
a complete solution.

(Disclosure: I was not particularly excited about the proposal at the
time.)

-Ben

---

From: "John Levine" <[email-masked]>
Date: 23 Jul 2018 13:39:48 -0400

>the problem, though some people seem to be thinking along the right directions.

WGs generally need to start with some drafts that are intended to
become standards.  Not seeing any of those, it seems like an RG would
be appropriate.

>It's a tough problem.

No kidding.  I'll ask about an RG.

R's,
John

---

From: Bret Jordan <[email-masked]>
Date: Mon, 23 Jul 2018 13:31:09 -0600

It is a very hard problem, but it is the kind of problem that we need to work on and try and solve. I just want to make sure this gets the focus it deserves.  

Thanks,
Bret

> On Jul 23, 2018, at 9:55 AM, Tim Hollebeek <[email-masked]> wrote:
>

---

From: Bret Jordan <[email-masked]>
Date: Mon, 23 Jul 2018 13:32:24 -0600

I think it would be great if we could organize some sort of Bar BOF or even less formal get together to talk about this. Maybe just stay late in one of the room one night???

Thanks,
Bret

> On Jul 23, 2018, at 10:09 AM, Nalini J Elkins <[email-masked]> wrote:
>

---

From: Bret Jordan <[email-masked]>
Date: Mon, 23 Jul 2018 13:33:16 -0600

Thanks John.  If a RG is the way to go right now, then lets do that.  Hopefully we can figure out a solution and start working on some standards that can be adopted and published. 

Thanks,
Bret

> On Jul 23, 2018, at 11:39 AM, John Levine <[email-masked]> wrote:
>

---

From: Nalini J Elkins <[email-masked]>
Date: Mon, 23 Jul 2018 19:50:52 +0000 (UTC)

> I think it would be great if we could organize some sort of Bar BOF or even less formal get together to talk about this. Maybe just stay late in one of the room one night???
Sure.  I am working with some of the enterprises to get some concrete examples of what has worked, what has not, and other concerns.
We can maybe even meet in an actual bar!   Let's discuss more as time approaches.
Thanks,BretPGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."

Nalini Elkins
CEO and Founder
Inside Products, Inc.
www.insidethestack.com
(831) 659-8360

-Tim

-----Original Message-----
From: saag <[email-masked]> On Behalf Of Adam Montville
Sent: Sunday, July 22, 2018 8:05 AM
To: John R. Levine <[email-masked]>
Cc: [email-masked]
Subject: Re: [saag] stopping (https) phishing

Bret

R's,
John

Regards,

---

From: Yoav Nir <[email-masked]>
Date: Mon, 23 Jul 2018 23:24:21 +0300

Next IETF no meetings will be scheduled on Friday exactly for things like this.

> On 23 Jul 2018, at 22:50, Nalini J Elkins <[email-masked]> wrote:
> 
> 
> 
> 
>> On Jul 23, 2018, at 10:09 AM, Nalini J Elkins <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> https://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach <https://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach>
>>