On Dec 6, 2013, at 11:19 AM, Bruce Perens <[email protected]> wrote: > On 12/06/2013 10:58 AM, Nicholas Weaver wrote: >> Include a checkbox in the browser saying "Fuck it all, show my data to the >> world" which broadcasts the session key in the clear. > I know you intended this to be sarcastic, but opting out of the concealment > society does not mean that the user doesn't have the sense to conceal things > when it is actually necessary, vs. when it is in their honest opinion an > off-the-scale response to the problem. > > Punishing them by revealing their credit card numbers is not an appropriate > response to their wanting to load static images, javascripts, and CSS in the > clear.
Then make the checkbox "Fuck it all, show my data to the world IF THE SERVER CONSENTS", and have the leakage require both the server and client. I'm not kidding here. Cleartext without data integrity is a outright risk on the current and future Internet. I don't care about surveillance. (Well, I do, but...). What I care about is attack surface for exploitation, an attack surface that is enormous, easy to use, and hey, the US government said "Game on!", and where everyone else can say "It wasn't me. And hey, even if it was, you started it, sauce pour l'oie..." Especially for "javascripts and CSS" which you seem so happy to pass in the clear: You let an attacker see a SINGLE ONE of your cleartext JavaScript or CSS fetches and you are FUBAR. Game over, you're p0wned, have a nice day. -- Nicholas Weaver it is a tale, told by an idiot, [email protected] full of sound and fury, 510-666-2903 .signifying nothing PGP: http://www1.icsi.berkeley.edu/~nweaver/data/nweaver_pub.asc
signature.asc
Description: Message signed with OpenPGP using GPGMail
_______________________________________________ perpass mailing list [email protected] https://www.ietf.org/mailman/listinfo/perpass
