Subject: Bar Bof on Federated Authentication Thursday at 9 PM during IETF week

From: Sam Hartman <[email-masked]>
Date: Mon, 08 Mar 2010 13:00:33 -0500

Folks, I'm trying to get a room for the federated authentication bar BOF
Thursday March 25 at 9 PM US Pacific time I've requested a room from the
secretariat and Pasi said he would approve the request, so we'll see
what their availability is.

I plan on starting out with a brief presentation on the problem and
solution architecture I'm working with, then we'll open it up to
discussion.  The goal of the discussion will be to determine if there is
sufficient interest to have a BOF at the next IETF and to understand
what steps we need to take between now and then.

For the announcement of the proposal see
http://www.ietf.org/mail-archive/web/emu/current/msg01363.html
and for our mailing list see
http://jiscmail.ac.uk/cgi-bin/webadmin?LIST=MOONSHOT-COMMUNITY

Thanks for your interest,

Sam Hartman
Painless Security, LLC

---

From: "Glen Zorn" <[email-masked]>
Date: Wed, 10 Mar 2010 07:51:25 +0700

Sam Hartman [[email-masked]] writes:

> discussion.  

Suddenly I'm nostalgic for the days when bar BOFs were impromptu affairs
that sprang up in, well, _bars_ & were of necessity free of PowerPoint
infestation...

The goal of the discussion will be to determine if there is
> _______________________________________________
> Ietf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf

---

From: Melinda Shore <[email-masked]>
Date: Tue, 9 Mar 2010 15:57:59 -0900

> that sprang up in, well, _bars_ & were of necessity free of PowerPoint

It wasn't that long ago that a member of the IESG was
objecting to calling them BOFs at all.  It used to be
the case that it was just a bunch of people talking,
and this stuff about rooms and presentations and whatnot
leads me to wonder if the "bar BOF" has graduated to
something that's got some level of sponsorship or
support from somewhere other than just the people who
show up, and whether or not that matters.

Melinda

---

From: Ole Jacobsen <[email-masked]>
Date: Tue, 9 Mar 2010 17:10:34 -0800 (PST)

Well there is CLEARLY an opportunity for the alcohol industry to 
engage in some high-profile sponsorship here. "When you think
geek in a bar, think Absolut..." 

It's a no-host meeting, but that doesn't mean it has to be a no-host
bar does it?

Ole

Ole J. Jacobsen
Editor and Publisher,  The Internet Protocol Journal
Cisco Systems
Tel: +1 408-527-8972   Mobile: +1 415-370-4628
E-mail: [email-masked]  URL: http://www.cisco.com/ipj

On Tue, 9 Mar 2010, Melinda Shore wrote:

> It wasn't that long ago that a member of the IESG was objecting to 
> calling them BOFs at all.  It used to be the case that it was just a 
> bunch of people talking, and this stuff about rooms and 
> presentations and whatnot leads me to wonder if the "bar BOF" has 
> graduated to something that's got some level of sponsorship or 
> support from somewhere other than just the people who show up, and 
> whether or not that matters.
> 
> Melinda
>

---

From: Dave Nelson <[email-masked]>
Date: Tue, 9 Mar 2010 22:03:14 -0500

Sent from my iPhone, wherein trimming posts is a challenge. :-)

On Mar 9, 2010, at 7:51 PM, Glen Zorn <[email-masked]> wrote:

> Suddenly I'm nostalgic for the days when bar BOFs were impromptu
> affairs that sprang up in, well, _bars_ & were of necessity free of
> PowerPoint infestation...

And replete with alcohol.  ;-)

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Wed, 10 Mar 2010 08:04:37 -0500

And there was a time when a Request For Comments was intended to be an
informal note, we seem to have made a mess there as well.

What I find sad about the whole identity/authentication area is the
way that we have so many frameworks and frameworks of frameworks and
complexity for what is a very simple problem. And I am sorry, but
doing the job the user wants done IS actually the easy part.

What is hard about federated authentication is the fact that there are
all these people who already think they have done something important
and that it must be part of the solution.

The result is a series of Frankenstein monsters with very visible
seams with irrelevant choices the user is presented with. My computer
knows I am logged into my Google mail account to write this note. Why
can't it figure out a seamless and entirely transparent method of
securely communicating that fact to other sites I might want to
access? That is not a hard problem, but it has been made hard by
insistence on irrelevant technology.

Last time we had a BOF on that subject matter we had people with the
bizarre notion that the user interface should be excluded from work on
user authentication.I don't care if usability is outside people's
comfort zone, if any group is going to be chartered in this space it
should be required to address usability issues or we are better off
without it.

-- 
-- 
New Website: http://hallambaker.com/
View Quantum of Stupid podcasts, Tuesday and Thursday each week,
http://quantumofstupid.com/

---

From: Steven Bellovin <[email-masked]>
Date: Wed, 10 Mar 2010 14:03:58 -0500

> And replete with alcohol.  ;-)
Yes -- a good supply of solvents is necessary for many IETF discussions...

		--Steve Bellovin, http://www.cs.columbia.edu/~smb

---

From: todd glassey <[email-masked]>
Date: Wed, 10 Mar 2010 14:37:31 -0800

> and that it must be part of the solution.

It's their jobs on the line and their professional credibility.

Todd

> seams with irrelevant choices the user is presented with. 
Something the Sponsor's have no idea about since the members rarely if
ever report to them.

> My computer
> access? 

because that would mean systems built by many different people would
actually have to work together and that means human ego's would be
damaged...

> That is not a hard problem, but it has been made hard by

---

From: Dave CROCKER <[email-masked]>
Date: Wed, 10 Mar 2010 18:37:58 -0800

> Yes -- a good supply of solvents is necessary for many IETF discussions...

is that because candid discussion requires participation that is unvarnished?

d/
-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net

---

From: "Thomas Hardjono" <[email-masked]>
Date: Wed, 10 Mar 2010 15:51:17 -0500

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
Of
> Phillip Hallam-Baker
> Sent: Wednesday, March 10, 2010 8:05 AM
> To: Melinda Shore
> Cc: [email-masked]; Glen Zorn; [email-masked]; moonshot-
> [email-masked]; Sam Hartman; [email-masked]
> Subject: Re: Bar Bof on Federated Authentication Thursday at 9 PM during
IETF
> week

If I understand the draft and motivations behind it correctly,
I think a large part of the proposal (draft-howlett-eap-gss)
is to develop machine to machine federated identity (and authentication).
Which is why Radius is involved (as it is a common directory
infra in many organizations) and SAML Request/Response used
to carry authz info.

So, I'm not sure that "user interface" is relevant here.
GSSAPI is the suggested API for applications.

Or did I read the wrong draft... :)

/thomas/

---

From: Leif Johansson <[email-masked]>
Date: Wed, 24 Mar 2010 19:21:10 +0100

On 03/10/2010 02:04 PM, Phillip Hallam-Baker wrote:

<snip>

> doing the job the user wants done IS actually the easy part.

Josh is basing his idea on significant deployment of some of those sad 
frameworks. Running code is King Yoda!

	Cheers Leif

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Wed, 24 Mar 2010 16:58:20 -0400

Code is currently king.

But in my view it is the user who we should make king.