Re: Proxies (includes call for adopting new work item, call for input)

On Sun, Jun 22, 2014 at 1:48 PM, Diego R. Lopez <diego@tid.es> wrote:

>
>  On 22 Jun 2014, at 21:48 , Eric Rescorla <ekr@rtfm.com> wrote:
>
>  However, I think the main *technical* issue here is what, if any,
> support browsers
>  ought to have for allowing network operators to install credentials
> which allow
> them to act as a proxy for connections which would otherwise be end-to-end
> secured between the client and the server. This may use the same technical
> mechanisms once that's done (and in fact it currently mostly does), but
> from
> a policy perspective it's totally different.
>
>
>  I disagree: I see the split UA policy-wise equivalent to the proxy once
> you install your browser: you put your trust on the browser developers
> *and* on the the proxy operator: when you install the browser you take a
> single leap of faith, from that moment on you (implicitly) putting your
> trust on the proxy operator: whether it is the same or a different
> organization that develop the browser is immaterial.
>

I'm not sure what to tell you. It doesn't seem like a very complicated
piece of
security analysis that trusting two people is a bigger deal than trusting
one.
And this is before we get to the fact that in many cases the MITM proxies
are in place specifically to ensure that the user uses the browser in
accordance
with the network's policies rather than his own, a situation that does not
apply
in a typical split browser scenario.

-Ekr



>  Be goode,
>
> --
> "Esta vez no fallaremos, Doctor Infierno"
>
> Dr Diego R. Lopez
> Telefonica I+D
> http://people.tid.es/diego.lopez/
>
> e-mail: diego@tid.es
> Tel:    +34 913 129 041
> Mobile: +34 682 051 091
> -----------------------------------------
>
>
> ------------------------------
>
> Este mensaje se dirige exclusivamente a su destinatario. Puede consultar
> nuestra política de envío y recepción de correo electrónico en el enlace
> situado más abajo.
> This message is intended exclusively for its addressee. We only send and
> receive email on the basis of the terms set out at:
> http://www.tid.es/ES/PAGINAS/disclaimer.aspx
>