09:18:54 RRSAgent has joined #strint 09:18:54 logging to http://www.w3.org/2014/02/28-strint-irc 09:25:30 swb has joined #strint 10:05:59 moneill2 has joined #strint 10:09:32 wselttzer, Hi Wendy - is there an audio channel? 10:28:24 dka has joined #strint 10:28:48 Melinda has joined #strint 10:51:02 dka_ has joined #strint 11:04:36 azet has joined #strint 11:05:12 no ssl for non-w3 account holders :( 11:11:06 moneill2 has joined #strint 11:30:14 hildjj has joined #strint 11:30:21 hildjj has joined #strint 11:32:09 jhildebr has joined #strint 11:32:36 11:54:12 While waiting for the workshop, an opinion about Internet governance (warning: high level of trollness) http://www.usnews.com/opinion/blogs/peter-roff/2014/02/25/will-obama-abandon-internet-freedom 12:05:07 wjontof has joined #strint 12:15:53 the specific plumbing may have been invented in the US, but Europeans (& public sector) invented the web 12:28:00 bjoern has joined #strint 12:30:05 grothoff has joined #strint 12:35:43 sftcd has joined #strint 12:39:28 BenL has joined #strint 13:00:17 bortzmeyer has joined #strint 13:28:22 'lut Stéphane, voulait dire "lots" mais mon N9 a raté un virage 13:43:27 swb has joined #strint 13:50:53 hildjj has joined #strint 13:57:55 W577C has joined #strint 13:59:41 getting started 14:00:28 Bert has joined #strint 14:01:23 Ted_ has joined #strint 14:01:40 npdoty has joined #strint 14:02:05 rrsagent, pointer? 14:02:05 See http://www.w3.org/2014/02/28-strint-irc#T14-02-05 14:02:47 Stephen Farrell introducing the workshop 14:03:05 audio? 14:03:37 Meeting: STRINT, Day 1 14:03:44 RRSAgent: username and password required 14:03:44 I'm logging. I don't understand 'username and password required', bortzmeyer. Try /msg RRSAgent help 14:03:57 Date: 28 February, 2014 14:04:01 rrsagent, set log public 14:04:07 bortzmeyer: try again 14:04:15 rrsagent, please draft minutes 14:04:15 I have made the request to generate http://www.w3.org/2014/02/28-strint-minutes.html rigo 14:04:25 fluffy has joined #strint 14:04:27 mnot has joined #strint 14:04:33 barryleiba has joined #strint 14:04:41 rigo: "Sorry, Insufficient Access Privileges" 14:04:46 coopdanger has joined #strint 14:04:58 GregWood has joined #strint 14:05:18 bortzmeyer: reload 14:05:46 rigo: it works. The NSA can now know what is aid 14:05:53 dcrocker has joined #strint 14:05:56 moneill2, audio will be at http://nagasaki.bogus.com:8000/stream10 14:06:06 MacroMan has joined #strint 14:06:39 dcrocker has left #strint 14:07:05 jphillips has joined #strint 14:07:13 dcrocker has joined #strint 14:07:14 jphillips has joined #strint 14:07:16 barryleiba1 has joined #strint 14:07:22 wseltzer has changed the topic to: STRINT Agenda: https://www.w3.org/2014/strint/agenda.html (with participation details) 14:08:38 jphillips has joined #strint 14:08:42 Does anyone know if the streaming audio is being recorded for later listening? 14:08:55 sftcd has joined #strint 14:09:01 hhalpin has joined #strint 14:09:08 66 submissions, around 150 people having submitted thoughts, only 100 had place, apologies to the others 14:09:19 cabo has joined #strint 14:09:46 AndroUser has joined #strint 14:10:09 scribenick: rigo 14:10:14 scribe: rigo 14:10:24 DThaler has joined #strint 14:10:30 kaie has joined #strint 14:10:34 Hardware failure in the audio, under way to fix 14:10:54 audio is working on that url 14:11:06 scribenick: .. 14:11:18 Is it being recorded too? 14:11:40 BenL has joined #strint 14:11:43 BenL has joined #strint 14:11:50 BenL has joined #strint 14:11:53 pde has joined #STRINT 14:12:11 -> http://down.dsg.cs.tcd.ie/strint-slides/ Slide presentations 14:12:46 JoeHallCDT has joined #strint 14:13:08 a pity that this server doesn't accept secure connections from non-w3c members :) 14:13:16 +1 14:13:17 scribenick: npdoty 14:13:40 smb has joined #strint 14:13:43 larrymasinter: not sure where we talk about other applications 14:13:51 pde, I'll send a sysreq 14:14:15 sfarrell: maybe in the metadata session to talk about what isn't sent, not just encryption 14:14:27 Is anyone acting as go-between, so we can possibly insert comments into the meeting? 14:14:33 dcrocker: expand scope beyond just SIP, Jabber, email 14:14:59 Zakim has joined #strint 14:15:05 mcmanus has joined #strint 14:15:07 dgilmore: coordination deprecation of existing algorithms 14:15:14 tara has joined #strint 14:15:23 s/dgillmore/dgillmor/ 14:15:38 kaplan: not just deprecating algorithms, but updating running software 14:16:15 When are we going to talk about deprecating TCP/IP? 14:16:19 elliotlear: if you're raising security questions, are you answering the generic security problem or just pervasive monitoring? please be specific 14:16:33 kodonog has joined #strint 14:16:45 farrell: a problem on perpass as well 14:17:17 @@: a lot of boxes out there, operational considerations; but also business model considerations, if the email provider needs to be able to read your email, that's probably not going to work 14:17:28 small correction: i'm suggesting expanding scope beyond the bulltetd goals item for web architecture concerns, to cover the other major architectures/services/ 14:17:44 brian trammel was the @@ speaker 14:17:44 ... some things we'll have to leave out for this workshop 14:18:03 s/@@:/brian trammel:/ 14:18:08 pde: good to start with some threat modeling, some problems are low-hanging fruit, encryption by default even if you're not protected against active attackers 14:18:15 ... should have been done long ago 14:18:23 ... next step would be detecting active attacks when they're happening 14:18:36 MaryB_ has joined #strint 14:18:43 ... 1) encrypt everything; 2) detect MITM; 3) address service provider business models etc 14:19:24 @@@: choose different terminology than opportunistic encryption, instead focus on the specific technology 14:19:35 s/@@@/Orit Levin/ 14:19:47 farrell: fix the different uses of that terminology, need to have a common understanding of that term, one goal for this workshop 14:20:15 grothoff: we talk about strengthening the Internet, not replacing it by a new (GNU?) network 14:20:24 dka has joined #strint 14:20:52 phil: won't create a new technology right now or even in the next 6 months; traditionally security area has demanded perfection against attackers focused on a single person, current problem is less like that 14:21:10 @@@@: should separate threat model and suggested solutions 14:21:28 That's Steve Kent 14:21:30 JoeHallCDT: not a lot of thinking in IETF about anonymity and building that into protocols, we're going to be doing some work on that 14:21:36 s/@@@@/stevekent/ 14:21:37 bortzmeyer: and I thought you were serious about addressing issues like PRISM and other NSA programs, not just verbally reassuring users. 14:22:04 wow, there's a lot of buffering in the audio. npdoty gets his comments out as the person starts talking :) 14:22:08 richardbarnes: it is important to come out with actionable stuff; areas where we need to work (like anonymity) that are fairly actionable 14:22:49 @@@: need to think about why a new proposal will be deployed when past solutions haven't been; understand the motivations of what determines deployment 14:22:56 GregWood_ has joined #strint 14:23:03 s/@@@/BernardAboba/ 14:23:07 farrell: encourage deployers to speak up 14:23:07 The scribe is using the thiotimoline interface. 14:23:35 leon_kaplan: many organizations are just small organizations with a single sysadmin; they don't have the resources; we need to give some good advice they can copy and paste 14:24:47 @@_edps: european data protection supervisor; we could enforce some compliance theoretically; good things are there but not used or they are misunderstood and that isn't solvable by IETF/W3C 14:24:59 ... work on this with volunteers to see how this can be improved 14:25:07 ... look at technologies beyond encryption, like minimization 14:25:37 stevebellovin: should be looking for a 90% solution that just works, for 90-95% of people and businesses that don't have extraordinary threat models 14:25:51 ... shouldn't have to make a lot of strange choices between algorithms and key lengths 14:26:15 ... for the few organizations that have stronger enemies, they can afford experts 14:27:11 josswr has joined #strint 14:27:15 moriarty: how can we create better connections within standards bodies (starting with authentication)? developer teams don't know who is using what, what's available, what the use cases are 14:27:38 ... would like something wiki-based as a starting point, and then reach out to standards bodies 14:27:52 ... references at wikipedia so that those other audiences will know where to go at IETF or W3C 14:27:58 ... our work would be promoted more 14:28:34 yeah, Wikipedia can be tedious for editors 14:28:45 alissacooper: define the areas that seem most fruitful, but also try to prioritize those areas -- which is low-hanging fruit and which comes later 14:28:54 ... also good to think about what not to work on 14:28:59 Any of us standards groups can host the wiki pages. 14:29:04 masinter has joined #strint 14:29:20 ... ... for example, browser fingerprinting, decide in areas where smart people have been thinking about it and maybe we need to put it aside for a while 14:29:33 ... if there is consensus on priorities 14:30:13 kai: users must demand they want to be more secure; define what is easily surveillable or more difficult 14:30:23 ... can we define standards / metrics of protection levels? 14:30:51 That's going to be a good point later -- creating better security does no good without upkeep 14:31:00 hhalpin: a lot of people are familiar with ietf/w3c but not everyone, so worth outlining the WGs that are rechartering 14:31:23 ... Web Crypto is being rechartered, for example 14:31:31 ... a lot of people really do want better security (anecdote: Whatsapp/Telegram) 14:31:47 And telegram rolled their own crypto, which is rather crazy at best. 14:31:59 phil: need to quantify work factor, know that NSA has a limited budget 14:32:05 http://www.thoughtcrime.org/blog/telegram-crypto-challenge/ 14:32:07 hhalpin, +1 14:32:19 we can maybe estimate from black budget... not sure helpful 14:32:27 dcrocker: we should worry about real usability, who will deploy it, why they will, what is necessary for users to benefit in the real world 14:32:27 We would really like folks to review the Web Crypto API, which is nearing Last Call and will also likely recharter by end of the year 14:32:33 rrsagent, please draft the minutes 14:32:33 I have made the request to generate http://www.w3.org/2014/02/28-strint-minutes.html npdoty 14:33:09 Topic: Threats 14:33:17 https://dvcs.w3.org/hg/webcrypto-api/raw-file/tip/spec/Overview.html (latest draft of Web Crypto API) 14:33:20 http://down.dsg.cs.tcd.ie/strint-slides/s1-threat.pdf 14:33:20 cullen: there's a ton of data being collected 14:33:38 ... what has raised the particular issue has been pervasive collection 14:33:46 ... IP address, MAC addresses, identifiers and content 14:33:57 collected by lots of people 14:33:58 ... being collected not by any single organization, many governments 14:34:00 ... not new 14:34:11 * audio is up, but the quality is sketchy 14:34:25 ... collected at carrier level; collected at transport level; collected at cloud service providers 14:34:40 ... attacks are changing over time: not just passive attacks, but also active attacks 14:34:41 bjoern has joined #strint 14:35:07 ... come out of this session with a clear idea of the threat model and the attacks 14:35:16 ... make sure we're working on things that do address the threat model 14:36:04 cabo has joined #strint 14:36:09 cullen: passive attacker can listen to communications or just correlate communications between alice and bob 14:36:14 EKR's? 14:36:19 http://down.dsg.cs.tcd.ie/strint-slides/ 14:36:53 ... mitigations: don't send the data if you don't have to; encrypt data; anonymization 14:37:25 ... active attacker: not just observing, but also changing communications 14:37:49 ... active attacks may actually be quite easy for the pervasive attacker to mount 14:38:08 ... often in a good position to get themselves bogus credentials 14:38:34 ... mitigations: authentication; have more than one way to verify who you're talking to; improving trust models 14:39:12 cullen: collaborators who willingly or unwillingly reveal information out to the attacker 14:39:30 witting or unwitting, willing or unwilling 14:39:45 ... might be directly taking keys and hand them to the attacker; or I generated keys in a way that the attacker could find out 14:39:53 sorry, witting or unwitting, *not* willing or unwilling 14:40:20 ... static key exfiltration: attacker finds out a key that is long-lived 14:40:20 s/willingly or unwillingly/wittingly or unwittingly/ 14:40:44 nice logo on this one:-) 14:41:10 ... versus dynamic key exfiltration: where the attacker needs to obtain the keys for each communication 14:41:49 ... content exfiltration: taking the content rather than the keys during the communication 14:42:33 cullen: attackers will do all of these; we can increase the costs of these, so the attacker has to move to the more expensive attacks, or makes it more visible and increases the risk that the attacker will be 'caught' 14:42:50 ... this is just level-setting, would like to hear from the room 14:43:28 barnes: make a list of the attacks, so we can scope and prioritize work based on how it addresses these attacks 14:43:39 fluffy has joined #strint 14:44:00 stevekent: should include content in the pervasive passive attack 14:44:33 barnes: yes, passive definitely includes content, the metadata/correlation was what is new 14:45:14 stevekent: identifying classes of adversaries by their motivations and their capabilities, separate from just the threat model 14:46:10 wseltzer: a helpful framework; it should be part of the design process to ask and answer against which threats you are designing 14:46:27 ... it's fair to address only some threats as long as we don't tell people we're addressing more than we are 14:46:30 I don't think we can/should identify classes of adversaries -- we don't know enough yet. We can understand the threat model without understanding who is doing the threatening. 14:47:09 Dave, dave, Ed, Stuart, Pete 14:47:42 Two attacker classes: those with national security letters and those without? 14:47:50 DThaler: far easier to detect an active attack than a passive attack, anything that helps us move from passive to attack helps in multiple dimensions 14:48:13 dcrocker: increasingly sensitive to distinction between handling metadata and content metadata 14:48:56 ted: not sure how valuable it is to classify the motivations of an attacker 14:49:08 ... a rathole in describing the motivations, which may be controversial terms 14:49:43 NSLs are pretty retail, it seems 14:49:43 unless they come for keys, but legal minds disagree if they can get that through NSLs 14:49:53 stuartcheshire: glad active attacks are included -- not that hard to switch to active attacks, like airport wifi 14:50:05 which slide is on the screen right now? 14:50:12 summary 14:50:14 cabo has joined #strint 14:50:30 ... very tempting to talking about encryption technologies and certificates as stopping attacks 14:50:42 ... but actually what they do is just make the attacks detectable 14:50:56 ... what we do is throw up a certificate warning 14:51:23 ... "that's how you know you're on the right site, because it always does that" 14:52:04 plh has joined #strint 14:52:21 crowd: the russian hacker would have had a good cert 14:52:46 stuartcheshire: not a scalable solution to complain about certificate problems 14:53:11 peteresnick: let's not throw things away because they're not immediately effective 14:53:31 ... the fact that a big cloud player starts encrypting (even if the attacker can do content exfiltration directly) 14:53:46 ... can move our infrastructure. might establish a basis for solving bigger problems down the road 14:53:48 kodonog has joined #strint 14:54:17 leon_kaplan: should add denial of service or jamming to encourage users to downgrade to unencrypted versions 14:54:34 ... some attackers will just slow it down massively, which looks innocent in a developing country 14:54:41 An adjunct to Pete's comment: there may be more than one attacker. Even if there infiltration by one, that's not the same result as cleartext, which is available to all attackers. 14:55:03 ... phishing is another attack, by intelligence agencies or others 14:55:33 barnes: figuring out when technologies get used, like HSTS 14:55:59 phil: need to think of actors not as monolithic groups -- for example, individual defectors within larger organizations 14:56:28 ... one consequence is loss of reputation, PR issues for organizations because of attacks on their users (Yahoo! in the news) 14:57:14 larrymasinter: don't see in the taxonomy attacks on services that are popular but don't require pervasive monitoring 14:57:39 ... application-level security might give traffic analysis more information rather than less 14:58:31 ... might be useful to categorize users: cognoscenti; vulnerable populations (children or elders) who might be abused; 14:59:19 @_johnson: there's an assumption that once you're encrypted, you're safe; we think there should be security and entanglement at the application layer as well 14:59:32 ... not sure where it fits within W3C / IAB / IETF mandate 14:59:57 @@@: not sure why we're not using public-key based routing 15:00:07 +1 Harold Johnson: crypto does not equal security - the issue is data minimization (obsfucation) 15:00:11 s/@@/HaroldJohnson 15:00:13 ... no way to MITM 15:00:42 s/@_johnson/HaroldJohnson/ 15:00:58 @@@: just hold a public key qr code in front of a webcam and then there's no way to go to the wrong place 15:00:59 BenL has joined #strint 15:01:06 s/@@@/CarolVanLynx 15:02:03 s/CarolVanLynx/Carlo van Lynx/ ? 15:02:19 GeorgeDanezis: @@@@ [scribe couldn't hear/understand] 15:02:21 s/van/von/ 15:03:03 Damezis was talking about subversion, actively frustrating attackers? 15:03:35 elliot: Ted asked if the motivations of the attacker are important; motivations are important for the user/administrator to understand how much money to spend to mitigate the attack 15:03:35 ... if I care, then I'll mitigate, otherwise I won't 15:03:47 ... at the end of the day, it will come down to implementers and users 15:04:34 farrell: how should we document the threat model so that it's understood by those designing / implementing / deploying? 15:04:41 For Eliot's point, not surprisingly, I fundamentally disagree. A valid mitigation against one attacker will work against others with similar capabilities but different motivations. 15:05:23 joehildebrand: requirements for the threat model, interoperability is important and if we don't have that we have a denial of service attack 15:05:35 s/@@@/We have now lots of known cases authentication systems are being subverted in order to fake, access routers being subverted as well. 15:05:37 ... has to be implementable by more than one group, so simplicity is a very important goal 15:06:06 barnes: interoperability serves a security function by making it testable 15:06:15 please remind people to state their names every time 15:06:29 pde: what do we do when we detect mitm? currently we show absurd error that trains people incorrectly 15:06:43 ... solution was called sovereign keys 15:07:02 ... bbc, eg, publishes a key in an append-only data structure 15:07:56 ... if the user sees a key that isn't the right one, the software uses a slower but safer technique 15:08:14 ... gave up on that for a sophisticated attacker / threat model based on China, but it might work for other models 15:09:04 kai: @@@@ [scribe didn't understand] 15:09:26 barnes: maybe not something for this workshop 15:09:45 s/@@@@/Are compromised home network devices (CPE) in-scope?/ 15:09:54 dcrocker: the reality is that this group is always going to go for solutions 15:10:08 ... think about higher-risk vs lower-risk solutions 15:10:42 ... object threats vs. venue threats: payload, payload metadata, transaction metadata vs link, support infrastructure, dns 15:11:14 @@@: rather than threat model, what is the risk model? 15:11:29 s/@@@:/Doug_Montgomery:/ 15:11:34 ... risks to performance, business models 15:11:43 ... risks of attacks vs. risks of successful deployments 15:12:19 barnes: what are the properties/ additional considerations beyond security: performance, business model 15:12:57 barryleiba has joined #strint 15:12:58 as a physicist, it's probably "emanation" rather than radiation 15:13:23 @@@@@: in protocol level interactions, what do we know that we radiate vs. what do we not know that we radiate 15:13:46 JMC has joined #strint 15:13:50 ... information radiation is important because even if we solve all encryption problems, there are patterns of bits on the wire 15:14:16 No, you can't remove it, but you can make the patterns much more expensive to see. 15:14:24 s/@@@@@:/Trammell:// 15:14:30 or make sense of. 15:14:37 hannes: is this taxonomy useful? to whom? 15:14:39 I'm not going to try to contribute, but for this group: there are so many things you can do with the pattern of bits on the wire! 15:14:59 ... in standards, try to develop abstract building blocks that will be used in a wide variety of contexts, so motivation doesn't matter 15:15:10 ... but does matter to the developer/deployer 15:15:57 ... so this list could be useful in a standards group, going through the list because confidentiality is otherwise considered expensive 15:16:24 leon_kaplan: useful to know how expensive is each attack and each defense 15:16:57 +1 to Dr. Fluffy 15:17:14 fluffy: impossible to get to the motivations of attackers in this case, anti-productive. could discuss capabilities in a broad context, which might provide the same information 15:17:47 dougm has joined #strint 15:18:01 Eventually it'll be useful to get into motivations, but for now we know enough of them at a coarse level, and have plenty to do with what we already know about threats, regardless of motivation. 15:18:05 stevekent: describe classes of attacks and give them numbers so that protocol authors can describe which of the enumerated attacks they are resolving 15:18:38 Is there a list of attendees somewhere? 15:18:54 ... motivations can be done without being pejorative; motivations of intelligence agencies for passive attacks because they don't want to be detected is still valuable 15:19:01 barnes: cost model of the adversary is useful 15:19:46 rigo: at the moment we are one step behind, have to see what people did to install pervasive monitoring 15:19:59 ... attacker is sitting at large IXP 15:20:24 ... tells us where encryption can be helpful 15:20:53 queue is closed - so irc can be my platform. We talk about driving up cost of attack as a defense - but driving up cost of mitigation is an attack itself because it will bifurcate the sol space 15:21:05 is that ekr? 15:21:12 Yes 15:21:30 ekr: centralization of cloud services creates a new locus of attack 15:22:00 ... places most secure from network attackers are least secure from attacks from government/lawful intercept 15:22:13 ... bring in new insights to inform protocol design 15:22:32 you got it, nick 15:22:59 @@: threat model is so wide/pervasive -- look at the relationship of those threats, where they might be a chain and a weakest link 15:23:10 +1 EKR. We don't want decentralized services insecure from network attackers, or centralized servers that are easily compelled by govt. attackers. I'd prefer a federated, decentralized approach based on well-reviewed standards. 15:23:15 The real issue is the relative RISK model. What is the risk/ramification of a adversary exploiting a know vulnerability, vs the risk of deploying a solution. Risk of solution includes, cost, complexity, fragility, new attack vectors, etc. 15:23:28 s/@@/Robachevsky/ 15:23:28 mcmanus, and then leave the demanders-of-greater-security part of a smaller anonymity set against traffic analysis 15:23:32 ... consider use cases to identify low-hanging fruit 15:24:07 Kathleen Moriarty 15:24:08 and risk to user, implementer, others? 15:24:23 moriarty: lots of instances of full-packet capture, analysts love it 15:24:48 Yes the risk of both attack and risk of solution is viewed differently by different players in the ecosystem. 15:24:52 barnes: how will protections affect emergency response 15:25:13 DThaler: one audience is W3C/etc., another audience is deployment -- this document is focusing on the first audience 15:25:14 pde has joined #STRINT 15:25:30 ... what's the incentive for someone to actually deploy something, fund mitigations 15:25:56 How much additional would you pay on your broadband bill to make PM more costly to highly resourced threats? 15:26:12 ... protecting data is one; protecting anonymity / reputation is another 15:26:28 Jiangshan has joined #strint 15:26:54 barnes: lots of useful comments for how we can make this document better 15:26:57 [catalog the threats as incentives to appeal to different parts of the corporate user, implementer, and designer communigy] 15:27:13 ... will try to improve the draft in the next little while 15:27:27 ... what's the process for moving this forward? perpass list, etc. 15:27:55 farrell: need to figure out what to do with the perpass list in IETF, what are we going to do with this draft, maybe split it for the two audiences 15:28:04 ... needs an AD sponsor 15:28:07 what' stone relationship between the Barnes draft and Trammell draft? 15:28:08 protecting anonymity and protecting reputationare two different things. My point is to cover such a list of things people who need to make a deployment change care about 15:28:14 -> https://www.w3.org/2014/strint/papers/44.pdf The draft: Pervasive Attack: A Threat Model and Problem Statement 15:28:28 s/what' stone/what's the/ 15:28:35 hannes: not sure this document can expand to cover this other audience 15:28:42 The perpass list should continue because we will need it for draft review -- see the Monday lunch meeting plan for example. 15:29:11 ... user-facing stuff is not in this document or in any others that I know of 15:29:25 barnes: I can be a central point for people who want to help on this document or related 15:29:42 [break for 1/2 hour] 15:29:48 rrsagent, generate minutes 15:29:48 I have made the request to generate http://www.w3.org/2014/02/28-strint-minutes.html wseltzer 15:29:53 < half hour break, start again at 4 o'clock > 15:31:53 AndChat|372521 has joined #strint 15:33:03 Where are the logs for this channel? 15:48:29 Alex_ has joined #strint 15:50:17 jphillips2 has joined #strint 15:52:01 jphillips: | RRSAgent I have made the request to generate http://www.w3.org/2014/02/28-strint-minutes.html 15:52:48 xaviermarjou has joined #strint 15:53:10 PHB has joined #strint 15:53:57 Satoshi has joined #strint 15:54:39 Testing 15:55:57 mcmanus has joined #strint 15:57:45 Thanks swb 15:58:13 wjontofs has joined #strint 15:58:53 Jiangshan has joined #strint 16:02:41 dougm has joined #strint 16:02:56 COMSEC 16:03:06 fluffy has joined #strint 16:03:16 cabo has joined #strint 16:03:25 hhalpin has joined #strint 16:03:29 JoeHallCDT has joined #strint 16:04:01 PHB has joined #STRINT 16:04:08 Minutes from me 16:04:11 npd has joined #strint 16:04:31 Don't expect me to recognize you, I can't see you here 16:04:51 It captures the thoughts?? 16:04:55 pde has joined #STRINT 16:05:03 The NSA must have given it to us 16:05:09 DThaler has joined #strint 16:05:15 barryleiba has joined #strint 16:05:20 donnelly has joined #strint 16:05:30 Ask to turn off the recorder for confidential stuff 16:05:41 Hannes: Comsec1 16:05:43 thanks, rigo 16:05:50 Benoit has joined #strint 16:05:56 This session we are looking at how to increase usage of current COMSEC tools 16:06:09 tara has joined #strint 16:06:11 LeslieDaigle has joined #strint 16:06:40 that doesn't sound like Hannes:-) 16:06:40 PhilippeDeRyck has joined #strint 16:06:52 Hannes: Great standards of papers, but not everything is deployed 16:06:58 HTTP: 16:07:03 Ted_ has joined #strint 16:07:37 dka has joined #strint 16:07:44 HObservation from Eckersley #438, CAs infastructure 16:07:54 slides at http://down.dsg.cs.tcd.ie/strint-slides/s2-comsec.pdf 16:08:00 % of websites using HTTPS is rather low still 16:08:13 alfredo has joined #strint 16:08:22 klc has joined #strint 16:08:53 SIP issues (see slides for details) 16:09:16 "jon has an attitude problem" :-) 16:09:45 SIP might have had an attitude issue, RTCWeb might be a chance to do it right because it is a different community 16:09:52 (yes) 16:10:19 i/COMSEC/scribenick: PHB 16:10:25 SCRIBE has joined #STRINT 16:10:36 Is this better? 16:10:44 :) 16:10:54