RE: Digest mess

Well Scott, I implement clients for a living and I can tell you that my
customers couldn't care less about mysterious third parties miraculously
appearing and targeting their Yahoo search requests or their MSN log-on
sessions. 

In fact most are even willing to send their e-mail in the clear.

I do have customers who have hard core security concerns. Some find SSL
sufficient for their needs. A good example of customers in that class are
people who perform credit card transactions over the Internet. Others need
much higher levels of security, which is why we work with third party
vendors to provide a whole range of application and transport level security
options.

But the overwhelming majority of my customers are much more concerned about
the very real threat of people sitting on the line sniffing passwords. Just
give them a way to get their passwords out of the clear and they would be
very happy. Digest does that.

Now, if you would like to discuss digest-ng, which gives my SSL customers a
way to get the security they need from a single key system while not blowing
a hole through the firewall, count me in.

			Yaron

> -----Original Message-----
> From:	Scott Lawrence [SMTP:lawrence@agranat.com]
> Sent:	Wednesday, January 07, 1998 10:53 AM
> To:	http-wg%cuckoo.hpl.hp.com@hplb.hpl.hp.com
> Subject:	Re: Digest mess
> 
> 
> >>>>> "DK" == Dave Kristol <dmk@bell-labs.com> writes:
> 
> DK> The conflicting positions (should Digest have some kind of integrity
> DK> check?) seem to stem from two different perspectives:
> 
> DK> 1) Servers want to identify users.  Neither the server nor the client
> is
> DK> particularly concerned about the integrity of messages (typically GETs
> DK> that return information to the client).
> 
>   I don't accept that at all.  If I'm a client requesting a form that
>   I'm going to submit authenticated, I'd like to know that the form is
>   what the server sent (not one with a new ACTION= attributed inserted
>   to send it somewhere else), and that the result of submitting the
>   form is equally authentic.  Both of these require server->client
>   authentication and message integrity.
> 
> DK> Can the two functions be separated so (1) can progress with "old"
> DK> Digest?
> 
>   I don't think so (but I bet no one is suprised at that).
> 
> --
> Scott Lawrence           EmWeb Embedded Server
> <lawrence@agranat.com>
> Agranat Systems, Inc.        Engineering
> http://www.agranat.com/

Received on Wednesday, 7 January 1998 22:32:08 UTC