Re: Security Considerations

["Robert Sayre" <sayrer@xxxxxxxxx>]

On 8/3/06, Eric Rescorla <ekr@xxxxxxxxxxxxxxxxxxxx> wrote:
> Apparently I wasn't clear. I meant what if my implementation *only* supports
> my new mechanism. I.e., I couldn't interoperate securely with someone who
> did Basic/TLS.

Yes, that's correct. So, your implementation would not be one of the
two we count on the move to DS, unless someone else implements your
scheme. Of course, it is obvious that would occur from reading the
RFCs.

I think it would be useful to show that the mandatory to implement
doctrine will result in the same situation, but less obviously. Let's
say we require Basic/TLS. BigCo writes a server that supports
Basic/TLS and BigCoFederation/TLS, and they donate the project to
Apache. When BigCo deploys the server for BigCoEmail.com (millions of
users, free accounts, many gigs of storage), they turn off support for
Basic/TLS.

In other words, the implementation/deployment distinction is not of
practical consequence for the Atom Protocol. I agree that encumbered,
proprietary, possibly insecure authentication schemes are harmful to
the Internet, but the servers are in control here, and
mandatory-to-implement authentication is not a way to prevent that
harmful stuff from occuring.

I am completely confident that we will get many interoperable
implementations with my text. Do you disagree?

--

Robert Sayre