Subject: Re: @EXT: RE: United Nations report on Internet standards

From: Fred Baker <[email-masked]>
Date: Thu, 2 Apr 2020 09:54:45 -0700

> On Mar 30, 2020, at 6:45 AM, Vittorio Bertola <vittorio.bertola=[email-masked]> wrote:
> 
> No one outside the IETF has problems with the IETF using its own traditional method to make technical choices. However, the concerns arise when the IETF makes policy choices that are de facto binding for the whole Internet. For example, privileging encryption over security is a policy choice. Designing technologies to circumvent national and personal content control points is a policy choice. IETF participants seem to oscillate between claiming that these are objectively good policy choices (as if an "objectively good" policy choice could ever exist) and claiming that these are in fact technical choices (but they are not).

Let me put a finer point on Keith's comment. "...privileging encryption over security" is a fairly interesting statement. The encryption people would, I think, tell you that encryption is a technology whose fundamental purpose is security, so it cannot be privileged over security. Now, on the other hand, in the TLS 1.3 discussion we have had people talking about privileging creating a new security key for every session over being able to debug operational problems in an operational environment, and I would say that is in fact very different; when security prevents people from debugging problems, that's something that I want the security people helping operators to solve.

In your statement, I think the word "security" needs a definition. Encryption got privileged over what, specifically?

A request we have gotten frequently from law enforcement is some form of back door - a way for law enforcement to bypass security technologies including (but not limited to) encryption under appropriate authority. The issue there has been an assumption - that the bypass was something that only law enforcement would or could use. Painful experience tells us that (quoting Europol's recent article on COVID-19, https://www.europol.europa.eu/newsroom/news/how-criminals-profit-covid-19-pandemic) organized crime is "very quick to adapt well-known ... schemes to capitalise on the anxieties and fears of victims throughout the crisis." One could say "fine, take the data back to the company and have them decrypt it". But we have ample history of organized crime finding ways to get companies to do that for them as well, such as LAPD's LAES engineer that got leaned on by organized crime (1997) with the result that organized crime was wiretapping the police.

I don't see a good way to ensure security that doesn't make law enforcement's job harder. I don't see the value of apologizing for that.

---

From: S Moonesamy <[email-masked]>
Date: Thu, 02 Apr 2020 13:01:32 -0700

Dear Sara,
At 02:47 PM 27-03-2020, Marcolla, Sara Veronica wrote:
>The issue is, when government representative participate to IETF (or 
>a RIR, or ICANN, or a NOG), they do so in their official capacity, 
>thus representing to some extent their organisation. They (we) do 
>understand the concept, however it is impossible to attend without 
>this sort of "official" hat. So on one hand there is Joe-as-himself, 
>and on the other hand there in Alice-as-a-whole-government-rep. How 
>do we make this work better for everyone's benefit in IETF?

My email address could be read as being from someone working for 
company X.  That could be someone who is working as a junior engineer 
or someone with an impressive job title.  In general, the former does 
not have much leverage in the company.  The latter might not 
understand SR-MPLS [1] or that the report which was attributed to the 
United Nations is not a report from that body.

Should the question be about what works for everyone's benefit?  In 
my opinion, it is easier to see whether the attendance in the IETF is 
worthwhile.  Does your organisation gain a commercial or other 
benefit from that?  I assume that someone within your organisation 
will be evaluating that if the organisation is paying for the expenses.

There are employees of a government in North America who have 
participated in the IETF. I don't see why participating in an 
official capacity would cause a problem in this venue.

Regards,
S. Moonesamy

1. https://datatracker.ietf.org/liaison/1677/

---

From: "Bron Gondwana" <[email-masked]>
Date: Fri, 03 Apr 2020 11:19:28 +1100

> Let me put a finer point on Keith's comment. "...privileging encryption over security" is a fairly interesting statement. The encryption people would, I think, tell you that encryption is a technol…

Malware detection
Exfiltration detection of private keys
Enumeration attack detection

Pretty much anything which looks for behaviour patterns across multiple endpoints is severely hampered by inability to correlate multiple datapoints. By pushing all the security out to the endpoints, they either have to coordinate threat information with each other by some side channel, or each is operating entirely in a vacuum.

"encryption is a technology whose fundamental purpose is security, so it cannot be privileged over security" is an extremist position that admits no nuance or tradeoffs - of which debugging that you already noted is just one.

For sure that in the antispam world, the ability to see patterns across a large set of messages is invaluable for classifying messages, and looking at each message right at the endpoints in isolation is much less effective.

Bron.

--
 Bron Gondwana, CEO, Fastmail Pty Ltd
 [email-masked]

---

From: Keith Moore <[email-masked]>
Date: Thu, 2 Apr 2020 21:13:40 -0400

On 4/2/20 8:19 PM, Bron Gondwana wrote:

> For sure that in the antispam world, the ability to see patterns 
> across a large set of messages is invaluable for classifying messages, 
> and looking at each message right at the endpoints in isolation is 
> much less effective.

Well, sure, but that's not a justification for email to be transmitted 
in cleartext.

(As Adm. Grace Hopper used to say, 'The worst reason to do anything is 
"we've always done it that way."')

Keith

---

From: "Bron Gondwana" <[email-masked]>
Date: Fri, 03 Apr 2020 12:19:44 +1100

> Well, sure, but that's not a justification for email to be transmitted in cleartext.

It might be a justification for email not being delivered directly to people's eyeballs; or to being processed by software running with privileges that allow it to access people's other data though - at least email from random sources with no prior relationship.

Bron.

---

From: "John Levine" <[email-masked]>
Date: 2 Apr 2020 21:20:58 -0400

In article <[email-masked]> you write:
>-=-=-=-=-=-

Sorry, but I don't understand this response.

We all agree that it is a good idea to encrypt mail passing between
servers or between servers and MUAs.  But there's a big difference
between mail encrypted in transit that the server can read and mail
encrypted with a per-user key that only the user's MUA can read.  As
Bron noted, a lot of services that users finde valuable work a whole
lot better if the user's mail server can see inside the mail.

R's,
John

---

From: Keith Moore <[email-masked]>
Date: Thu, 2 Apr 2020 21:29:42 -0400

On 4/2/20 9:19 PM, Bron Gondwana wrote:

>>> across a large set of messages is invaluable for classifying 
>>> messages, and looking at each message right at the endpoints in 
>>> isolation is much less effective.
>>
> It might be a justification for email not being delivered directly to 
> people's eyeballs

I'm not aware of any email system that delivers messages directly to 
people's eyeballs.   There are MSAs and message stores.

Or to put it differently, if people want to use an email system that 
delivers mail directly to their eyeballs, they're giving up one kind of 
spam filtering by making that choice.   Which might be a reasonable 
choice for some and not for others.

Keith

---

From: Keith Moore <[email-masked]>
Date: Thu, 2 Apr 2020 21:32:30 -0400

> lot better if the user's mail server can see inside the mail.

Entirely agree.   Though I will also argue that there's a need for 
encryption all the way between the MSA and message store. And different 
users may reasonably make different compromises between the degree of 
privacy that they need for their email and the degree of spam/malware 
detection that they need.

Keith