Re: [W3C Web Crypto WG] Rechartering discussion

Hello,

As a participant in the Sept. 10-11, 2014 Web Crypto Next Steps
http://www.w3.org/2012/webcrypto/webcrypto-next-workshop/
(and as a person who had a paper (however brief) accepted for that
workshop),
-- 
It sounds as though there is an effort underway to limit the scope of what
this group will be discussing, in such a manner that would not include
user-managed storage of keys, and that would attempt to diminish the
importance of trustless systems while encouraging users to place more trust
in exchange for convenience in various ways with a variety of services, but
where this group for rechartering as has been proposed above, would only
focus on "rechartering discussions in specific and narrow scopes if such
proposals have consensus (in particular, from user agents)" uh-huh.

At least, that's what the drift of it sounds like to me, and I don't like
the sound of that.  I sense this strange struggle where:

tl'dr"  some people don't want users to be in control of their keys, and
would rather info dump into the vast ether of FISA, business records, 3rd
party cromnibus, etc., because hey, it's important to make sure that you
squeeze all the profit you can out the users before discarding them, right?
or,
other people, perhaps wanting to give the users a better chance, try to
give the users more of a choice in where they will store their keys and
what happens next (thanks maxwell and chris and those at keybase, as
examples).

Please advise what is the course of the group.  Thank you.  I just don't
want to be here if the basic course is "oh let's um narrow it and try to
throw people to the wolves but pretend we're not"

tl'dr:  Change course.

-c





On Wed, Jan 7, 2015 at 4:31 PM, Richard Barnes <rlb@ipv.sx> wrote:

>
>
> On Wed, Jan 7, 2015 at 7:43 PM, Ryan Sleevi <sleevi@google.com> wrote:
>
>> As noted during the F2F during the 2014 TPAC, it's unlikely we would
>> be able to support such a rechartering.
>>
>> In the goals, only the first goal is something that aligns with our
>> interest.
>> In the scope, we are explicitly not interested in "user managed"
>> storage and "web certificate management". Further, we don't believe
>> this group is the appropriate venue for the discussion of Web
>> Authentication - that would be better for WebApps or WebAppSec.
>> WebAppSec already has proposals for dealing with credentials -
>> http://lists.w3.org/Archives/Public/public-webapps/2014JulSep/0141.html
>>
>> Put differently, for a rechartering, the only effort we'd likely
>> support support is the maintenance and exploration of algorithms.
>>
>> Any other chartering discussions should follow the highly productive
>> workmodes of WebApps and WebAppSecs - that is, concrete, defined
>> proposals being brought forth and holding rechartering discussions in
>> specific and narrow scopes if such proposals have consensus (in
>> particular, from user agents).
>>
>
> Reserving the right to disagree with Ryan on the particular scoping above,
> I strongly agree with the above paragraph.  None of the proposed work items
> to date has been defined in enough scope to make it clear what a WG would
> do.
>
> --Richard
>
>
>
>>
>>
>> On Wed, Jan 7, 2015 at 1:48 AM, GALINDO Virginie
>> <Virginie.Galindo@gemalto.com> wrote:
>> > Dear all,
>> >
>> >
>> >
>> > Web Crypto WG charter [1] will end by the end of March. We need to
>> prepare
>> > the next charter of Web Crypto.
>> >
>> >
>> >
>> > As a reminder, the conversation has started on this page :
>> > https://www.w3.org/Security/wiki/IG/webcryptonext_draft_charter
>> >
>> > Feel free to add you ideas and suggestions on the wiki and/or expose
>> your
>> > opinion and question on the public-webcrypto@w3.org or
>> > public-webcrypto-comment@w3.org (for non W3C Web Crypto WG members).
>> >
>> >
>> >
>> > Regards,
>> >
>> > Virginie
>> >
>> >
>> >
>> > [1] http://www.w3.org/2011/11/webcryptography-charter.html
>> >
>> >
>> >
>> > ________________________________
>> > This message and any attachments are intended solely for the addressees
>> and
>> > may contain confidential information. Any unauthorized use or
>> disclosure,
>> > either whole or partial, is prohibited.
>> > E-mails are susceptible to alteration. Our company shall not be liable
>> for
>> > the message if altered, changed or falsified. If you are not the
>> intended
>> > recipient of this message, please delete it and notify the sender.
>> > Although all reasonable efforts have been made to keep this transmission
>> > free from viruses, the sender will not be liable for damages caused by a
>> > transmitted virus.
>>
>>
>