On 04/07/2014 08:03 AM, Ted Lemon wrote:
On Apr 7, 2014, at 7:01 AM, Stephen Farrell
<stephen(_dot_)farrell(_at_)cs(_dot_)tcd(_dot_)ie> wrote:
Yes, we ought move away from passwords if/when we ever find an
acceptably better solution, and yes, people ought manage their
passwords well, but neither are today's reality more's the pity.
Perhaps it would be worth setting up support for client certs as a way to log
in to IETF services. If we won't start, why would someone else?
(Speaking as 1/15th, but only 1/15th, of the IESG that's asking for
community input on this topic)
For me, "If we won't start, why would someone else?" was a significant
consideration. I'm not locked in on any particular path, but I thought
it was useful to ask about this was that if the IETF can't make an
improved security environment work, that's not a good sign
(http://en.wikipedia.org/wiki/Eating_your_own_dog_food).
We can spin up new working groups to address problems we encounter. Most
communities seeking to improve their security environment can't do that.
So, from my own perspective, on-by-default would be sufficient to find
out what I'd like to find out ... but I'd love to find out at least part
of what we'd like to know, in a post-Snowdon world.
We could find out something, without making Stewart run a
state-of-the-art secure environment on his IoT device to FTP Internet
Drafts.
Spencer