Re: Proxies (includes call for adopting new work item, call for input)


On 23 Jun 2014, at 03:34 , Albert Lunde <atlunde@panix.com> wrote:

> On 6/22/2014 3:48 PM, Diego R. Lopez wrote:
>> On 22 Jun 2014, at 21:48 , Eric Rescorla <ekr@rtfm.com
>>> However, I think the main *technical* issue here is what, if any,
>>> support browsers
>>> ought to have for allowing network operators to install credentials
>>> which allow
>>> them to act as a proxy for connections which would otherwise be end-to-end
>>> secured between the client and the server. This may use the same technical
>>> mechanisms once that's done (and in fact it currently mostly does),
>>> but from
>>> a policy perspective it's totally different.
>>
>> I disagree: I see the split UA policy-wise equivalent to the proxy once
>> you install your browser: you put your trust on the browser developers
>> *and* on the the proxy operator: when you install the browser you take a
>> single leap of faith, from that moment on you (implicitly) putting your
>> trust on the proxy operator: whether it is the same or a different
>> organization that develop the browser is immaterial.
>
> It seems like there's an important distinction between (1) all intermediaries that look like a "proxy" when viewed as a black box, and (2) intermediaries that follow some protocols on the wire standardized in IETF specs.
>
> (1) can follow any protocol internally by private agreement (or just be a unilateral intercept by corruption of protocols, like CA and/or DNS spoofing.) But it still may speak standard HTTP on the outer interfaces.
>
> One motive for trying to standardize more about proxies is to surface and specify legitimate use cases. ("Legitimate" as defined by the people owning the systems and networks involved.)

Fully agree. I think this is the kind of distinction that we should make, and addressing and characterizing (2) into those legitimate use cases a goal I certainly support to pursue.

Be goode,

--
"Esta vez no fallaremos, Doctor Infierno"

Dr Diego R. Lopez
Telefonica I+D
http://people.tid.es/diego.lopez/

e-mail: diego@tid.es
Tel:    +34 913 129 041
Mobile: +34 682 051 091
-----------------------------------------


________________________________

Este mensaje se dirige exclusivamente a su destinatario. Puede consultar nuestra política de envío y recepción de correo electrónico en el enlace situado más abajo.
This message is intended exclusively for its addressee. We only send and receive email on the basis of the terms set out at:
http://www.tid.es/ES/PAGINAS/disclaimer.aspx

Received on Monday, 23 June 2014 07:58:17 UTC