Opportunistic Security: Some Protection Most of the Time
draft-dukhovni-opportunistic-security-06

Thanks for the extra cycle on this document. I think the added polish has made for a much better document.

No objection to the publication of the document, but please engage in the discussion, and clarify the text.

I don't understand what a "OS protocol" is, for example in section 5 "operational considerations"?
Is this a protocol that follows the OS definition, so that use a cleartext as the baseline communication security policy, with encryption and authentication negotiated and applied to the communication when available?
Or is this one protocol that follows the principles in section 3?

The following point is key to me

 No misrepresentation of security:  Unauthenticated, encrypted
      communication must not be misrepresented to users or in
      application logs of non-interactive applications as equivalent to
      authenticated, encrypted communication.

I would go as far as telling that the communication characteristics (encrypted with authentication versus encrypted without authentication) must be clearly labeled to the end user, and not only in a log. Who reads log files, anyway?
That reminds me of the questions asked during one of the plenaries: are you in favor opportunistic encryption?
I bet that many people thought: well encryption is good, opportunistic has got a positive touch. So sure, I'm in favor.
If my mother would see "opportunistic encryption" when communicating with his bank application, I'm sure she would think: yep, everything is good!

woud prefer


 However, when such attacks are employed pervasively in order to
 facilitate e,g, surveillance, this is probably detectable; hence,
 even in such scenarios OS protocols may provide a positive benefit.

but I've said my piece and I will trust the shepherding AD.

was:

hanging on Ted's point a bit. I might clear if he does.

If the use of what are essentially transparent proxies makes downgrade attacks, or effectively the removal of OE signaling entirely trivial then certain people will do that routinetly in order to support all sorts of ugly business models (the prexy is already there).

if you read about other cases that are effectively downgrades you can sort of imagine how insidious it is to think you reducing the visible surface area when in fact it's being stripped off again.

http://www.theregister.co.uk/2014/11/20/gotcha_google_caught_stripping_ssl_search_from_bt_wifi_users_searches/

The document is much improved in -05. Thank you for circling back around.