Subject: Re: Request for review and consensus -- draft-hartman-webauth-phishing

From: Simon Josefsson <[email-masked]>
Date: Mon, 08 Sep 2008 11:02:00 +0200

The document says that the intended status is 'Informational'.
Statements such as "IETF recommends", and normative words such as 'MUST'
as used as per RFC 2119, appears inconsistent with the intended use of
the 'Informational' status (RFC 2026 4.2.2):

   An "Informational" specification is published for the general
   information of the Internet community, and does not represent an
   Internet community consensus or recommendation.

Thus, I suggest that either

1) The intended status of the document is changed to
   Best-Current-Practice.

2) The normative words, references to RFC 2119, and statements regarding
   'IETF recommends' are removed.

I would prefer 1).

Thanks,
Simon

Lisa Dusseault <[email-masked]> writes:

> You may have seen this draft a year ago; Sam is back working on it and
> produced version -09 last month.
>
> http://tools.ietf.org/html/draft-hartman-webauth-phishing-09
>
> If you've reviewed it before, please take a look at the changes.  If
> you'd like to review it, please do.  I'm the shepherd for this draft,
> so comments can be sent to me, to Sam as author, to
> [email-masked] , or to the IETF general list as
> appropriate.
>
> In addition to getting general input, I'd like to get a sense of
> whether we have consensus on a couple things.
>
> a).  The statement including "IETF recommends", from section 1.1 of
> the draft:
>
>    "In publishing this memo, the IETF recommends making available
>    authentication mechanisms that meet the requirements outlined in
>    Section 4 in HTTP user agents including web browsers.  It is hoped
>    that these mechanisms will prove a useful step in fighting phishing.
>    However this memo does not restrict work either in the IETF or any
>    other organization.  In particular, new authentication efforts are
>    not bound to meet the requirements posed in this memo unless the
>    charter for those efforts chooses to make these binding
> requirements.
>    Less formally, the IETF presents this memo as an option to pursue
>    while acknowledging that there may be other promising paths both now
>    and in the future."
>
> b) Whether the document should require mutual authentication (section
> 4.4).
>
> Thanks,
> Lisa D.
_______________________________________________
Ietf mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ietf

---

From: Sam Hartman <[email-masked]>
Date: Tue, 09 Sep 2008 08:48:48 -0400

Simon, can I get you to analyze what position the IETF should take on
these issues--what form of consensus we're looking for.

For my part, it doesn't make sense to pursue this within the IETF
context--responding to feedback, trying to get a draft that everyone
is happy with--if the IETF is going to take no position.

I agree we need to have a discussion about status.  But first, I'd
like to separate the discussion of what we're getting the IETF to
agree on.

Would you support the IETF making the statement is section 1.1?  If
not, what would you support, or what changes could we make to get to a
point where you would support the statement in section 1.1.