Re: [dix] Re: [Ietf-http-auth] New draft on anti-phishing requirements

[Nicolas Williams <Nicolas.Williams at sun.com>]

On Mon, May 22, 2006 at 10:12:49AM -0700, Eric Rescorla wrote:
> Sam Hartman <hartmans-ietf at mit.edu> writes:
> 
> >>>>>> "Eric" == Eric Rescorla <ekr at networkresonance.com> writes:
> >
> >     Eric> This is all pretty much laid out in the PwdHash and Felten
> >     Eric> papers.
> >
> > Sure.  My goal here is to describe a series of reasonably obvious
> > requirements so that we can evaluate solutions because we'e seen some
> > solutions like the ones you cite that meet a large number of these
> > conditions and we've seen other solutions that do not.
> 
> This was in response to Nico asking:
> 
>  "So, the protocols and the [secure] UI have to be "combined" -- can you
>  expand on this? "

I asked two other questions in the same paragraph.  All three were aimed
at rooting out whether you happen to be in broad agreement with Sam's
position.  This particular question was aimed at understanding in what
respects your view differs from Sam's.  Pointing me at these papers
doesn't answer my question :)

But I'll score you two as being in broad agreement anyways (if nothing
else it's a safe bet).

Nico
-- 

_______________________________________________
dix mailing list
dix at ietf.org
https://www1.ietf.org/mailman/listinfo/dix