Re: WebCrypto - In "progress" since 2012

manu has sent a mail since i started thinking about this one...  so;...  So
with great admiration for you both; i still found the tone of review below
less helpful; understanding i can be guilty of the same at times in
frustration...

moving on.

FiDo is a good thing.  HTTP Signatures being implemented by Henry is a good
thing.  We're making progress.  So, WebCrypto.. May i redirect towards an
area that relates, but i'm far more interested in as a resolution item...

how can we universally agree on the problem about 'human' as to supports
the spirits of law, humility, shared values, human rights and all such
things as to bring us together in a manner that says we are flesh not
tools.

Problem at the moment seems flesh doesn't have enough support to defend its
right to life (something tools don't have) from the attacks of tools.

tim.h.
On Sat, 30 Apr 2016 at 18:09 Henry Story <henry.story@bblfish.net> wrote:

>
> > On 30 Apr 2016, at 05:34, Harry Halpin <hhalpin@w3.org> wrote:
> >
> >>>
> >>> More importantly, how is your vague complaining supposed to be in any
> >>> way helpful?
> >>>
> >>> What are we supposed to take away from your message?
> >>
> >> The thing I mentioned as another way forward.  It has IMO much better
> >> chances of getting traction because crypto without trusted UI and
> >> trusted storage isn't that terribly useful.
> >>
> >> These topics were either rejected or ignored by the WebCrypto WG.
> >
> > For good reason. There isn't such a thing really as 'trusted UI' that
> > users understand and there isn't a unified thing such as 'trusted
> storage.'
>
> Harry is defending some very contradictory positions if you look at his
> statements across the W3C globally.
>
> 1) On User Interface
>
> I note that Harry is a huge defender of FIDO which of course does have user
> interfaces to allow the operating system/hardware to put the owners of the
> hardware in control of key usage and does have trusted storage (usually
> hardware
> based). So Harry as a staff member of the W3C thinks that good UI design
> is too difficult
> for browser vendors, but is ok for hardware vendors and closed consortia
> to define.
> Perhaps Harry is preparing to move there?
>
> 2) cross origin
>
> One reason Harry gives for defending FIDO is that the cryptography it uses
> is single origin, which is interpreted by Harry as an Absolute Requirement.
> "Every key MUST only be used for one origin"
>
> On this interpretation of Single Origin the WebCrypto API is an aberration
> and
> actually bad for the web since it allows cross origin usage of keys. It
> actually
> allows authentication across origins using HTTP-Signature which I have
> implemented [1].
>
> So the doors Harry Opens Up here he actually closes in other fora.
>  - Harry praises UI work done in a closed forum (FIDO) but says it is
> impossible
>    for browser vendors to achieve
>  - Any potentially viral application of Web Crypto - which requires cross
> origin -
>   is slammed with the flimsiest of arguments
>
> These two positions are not accidental of course. The declaration without
> argument
> that User Interfaces that put the user in control of Web Crypto are
> impossible for
> browser vendors and that cross origin is bad, are designed to stop
> progress being
> made while making it look like Harry is actually pushing forward standards
> in this space.
>
>  Harry is actually acting as a conceptual guard placed in front of a
> conceptual
> door. (Wether he is aware of the role he is playing I am not sure.) The
> door
> that he - or those who have put him in the position he is in - do not want
> opened
> is the door that puts users in control of their keys. That position does
> have its
> vocal and powerful defenders: those arguing for key escrow. [2]
>
> Henry
>
>
> [1] https://github.com/solid/solid-spec/issues/52
> [2] https://en.wikipedia.org/wiki/Key_escrow
>
>
>
>
>