[14012] in cryptography@c2.net mail archive
Re: Is cryptography where security took the wrong branch?
daemon@ATHENA.MIT.EDU (Peter Gutmann)
Wed Sep 3 10:41:39 2003
X-Original-To: cryptography@metzdowd.com
X-Original-To: cryptography@metzdowd.com
Date: Thu, 4 Sep 2003 02:00:34 +1200
From: pgut001@cs.auckland.ac.nz (Peter Gutmann)
To: iang@systemics.com
Cc: cryptography@metzdowd.com, ekr@rtfm.com
Ian Grigg <iang@systemics.com> writes:
>There appear to be a number of metrics that have been suggested:
>
> a. nunber of design "wins"
> b. penetration into equivalent unprotected market
> c. number of actual attacks defeated
> d. subjective good at the application level
> e. worthless measures such as deployed copies, amount of traffic
> protected
You forgot the most important one:
f. value added elsewhere
SSL's real strength is that it's convinced 100 million Joe Sixpacks that it's
safe to make purchases online. This has nothing to do with security (you
could do the same with padlock GIFs stuck on your web page), but does count as
some sort of measure of "success", although it's marketing success rather than
security success. Although they provide about the same level of real
security, it seems that SSH is the tool of choice for people who care about
providing real security while SSL is the tool of choice for people who care
about providing their customers warm fuzzies.
Peter.
---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo@metzdowd.com
