Subject: Re: [Simple] TLS or Not for CEMA

From: Dean Willis <[email-masked]>
Date: Thu, 8 Sep 2011 17:09:13 -0500

On Mon, Aug 22, 2011 at 11:37 AM, Eric Burger <[email-masked]>wrote:

>
> Because the purpose of CEMA is enabling end-to-end encryption, there has
> been some debate as to whether, when two CEMA-endpoints are negotiating, TLS
> is mandatory or optional.
>
>
Given the security disasters we've recently witnessed with interception of
search engine traffic and the current push to "https everywhere" (see:
https://www.eff.org/https-everywhere) I think doing anything short of MUST
USE TLS would be reprehensible.

While TLS is no absolute guarantee (see the recent spate of attacks on CAs
resulting in the issuance of bogus certs), it's by far the best thing we
have going now.

Scaling is a non-issue. All my Google traffic is now TLS (or something much
like it, depending on what you think about SPDY) and they don't seem to be
complaining much.

But without it being mandatory in the spec, we can be sure people are going
to defer doing it until it's too late to matter.

Just do it. Save a few lives, feel good about yourselves, tell your kids you
helped make the world a better place today.

--
Dean

---

From: Dean Willis <[email-masked]>
Date: Thu, 8 Sep 2011 17:11:42 -0500

On Fri, Aug 26, 2011 at 9:10 AM, Cullen Jennings <[email-masked]> wrote:

>
> Are you seriously saying no one would ever use MSRP in an enterprise
> network?
>
>
Given that most security threats are inside the enterprise, you really ought
to be using TLS even inside your enterprise network.

I'm still trying to get TLS on my HP JetDirect printer ...

--
Dean