Subject: [http-auth] HTTP-Auth BoF in Quebec City Postponed

From: Mark Nottingham <[email-masked]>
Date: Wed, 20 Jul 2011 20:35:18 +1000

The BoF chairs, in consultation with Peter (the responsible AD), have decided that it's best NOT to hold a BoF for HTTP authentication in Quebec City, because the scope is still ill-defined, and the timing prevents several stakeholders from participating. 

Our hope is to be able to facilitate a BoF at an upcoming meeting, after there has been more preparation and coordination, so as to enhance its chance of success (i.e., identifying useful work for the IETF to do, in coordination with implementers as well as other efforts).

We encourage participants to continue discussing the various aspects of the problems as well as potential solutions, both on the list and in Quebec City (perhaps at an informal meeting).

--
Mark Nottingham and Alexey Melnikov

---

From: Yoav Nir <[email-masked]>
Date: Sun, 24 Jul 2011 22:28:26 +0300

Hi.

Would the people interested in http-auth like to hold an informal meeting sometime during the week?

If we don't want to have future BoFs canceled again, we should have a more clear definition of what problem we are trying to solve.

The first thing is to define what is bad in the current situation. I think we've seen two claims about this:
- Authentication to a web site means sending a password in the clear to some web site that may or may not be the correct site.
- A website that requires log-ins has to either store passwords or password verifiers. A compromise of that database is disastrous, because users re-use passwords for other sites.

After deciding which issue we would like to address, we can decide if the direction we would like to take is a more secure password protocol, or whether we would like to go to some solution that does away with passwords altogether.  I think there has been some meaningful discussion on the mailing list, but I don't see those discussions converging.

Do you think meeting face-to-face can help us move forward?

Yoav

---

From: Nico Williams <[email-masked]>
Date: Sun, 24 Jul 2011 14:37:30 -0500

Sadly I cannot attend.  I planned my travel schedule for this week
around the original BoF, and so I depart Quebec in the afternoon.  I
look forward to the notes from any bar BoF :)

Nico
--

---

From: Peter Saint-Andre <[email-masked]>
Date: Sun, 24 Jul 2011 18:54:11 -0400

> look forward to the notes from any bar BoF :)

A few of us got together just now in a side room to chat informally.
We'll post further about some actions sometime soon. :)

Peter

-- 
Peter Saint-Andre
https://stpeter.im/