[4582] in Privacy_Forum
[ PRIVACY Forum ] Addendum re: "Trusted Proxies"
daemon@ATHENA.MIT.EDU (PRIVACY Forum mailing list)
Mon Feb 24 22:24:18 2014
Date: Mon, 24 Feb 2014 18:45:18 -0800
To: privacy-list@vortex.com
Message-ID: <20140225024518.GA18115@vortex.com>
MIME-Version: 1.0
Content-Disposition: inline
From: PRIVACY Forum mailing list <privacy@vortex.com>
Reply-To: PRIVACY Forum mailing list <privacy@vortex.com>
Content-Type: text/plain; charset="iso-8859-1"
Errors-To: privacy-bounces+privacy-forum=mit.edu@vortex.com
Content-Transfer-Encoding: 8bit
Addendum regarding Trusted Proxies
(Reference: http://lauren.vortex.com/archive/001076.html)
Since my posting regarding "Trusted Proxies" two days ago, I've seen
some commentary (in at least one case seemingly "angry" commentary!)
suggesting that I was claiming the ability of ISPs to "crack" the
security of existing SSL connections for the "Trusted Proxies" under
discussion. That was not my assertion.
I didn't try to get into technical details, but obviously we're
assuming that your typical ISP doesn't have the will or ability to
interfere in such a manner with properly implemented traditional SSL.
That's still a significant task even for the powerful intelligence
agencies around the world (we believe at the moment, anyway).
But what the proposal does push is the concept of a kind of half-baked
"fake" security that would be to the benefit of dominant ISPs and
carriers but not to most users -- and there's nothing more dangerous
in this context than *thinking* you're end-to-end secure when you're
really not.
In essence it's a kind of sucker bait. Average users could easily
believe they were "kinda sorta" doing traditional SSL but they really
wouldn't be, 'cause the ISP would have access to their unencrypted
data in the clear. And as the proposal itself suggests, it would take
significant knowledge for users to understand the ramifications of
this -- and most users won't have that knowledge.
It's a confusing and confounding concept -- and an unwise proposal --
that would be nothing but trouble for the Internet community and
should be rejected.
--Lauren--
Lauren Weinstein (lauren@vortex.com): http://www.vortex.com/lauren
Co-Founder: People For Internet Responsibility: http://www.pfir.org/pfir-info
Founder:
- Network Neutrality Squad: http://www.nnsquad.org
- PRIVACY Forum: http://www.vortex.com/privacy-info
Member: ACM Committee on Computers and Public Policy
Lauren's Blog: http://lauren.vortex.com
Google+: http://google.com/+LaurenWeinstein
Twitter: http://twitter.com/laurenweinstein
Tel: +1 (818) 225-2800 / Skype: vortex.com
_______________________________________________
privacy mailing list
http://lists.vortex.com/mailman/listinfo/privacy
