Re: [dix] Re: [Ietf-http-auth] New draft on anti-phishing requirements

[Eric Rescorla <ekr at networkresonance.com>]

Sam Hartman <hartmans-ietf at mit.edu> writes:

>>>>>> "Eric" == Eric Rescorla <ekr at networkresonance.com> writes:
>
>     Eric> This is all pretty much laid out in the PwdHash and Felten
>     Eric> papers.
>
> Sure.  My goal here is to describe a series of reasonably obvious
> requirements so that we can evaluate solutions because we'e seen some
> solutions like the ones you cite that meet a large number of these
> conditions and we've seen other solutions that do not.

This was in response to Nico asking:

 "So, the protocols and the [secure] UI have to be "combined" -- can you
 expand on this? "


> I find specific requirements useful in such situations.

Right. I indicated in my message, I'm not sure this draft dissects the
reqts correctly.

-Ekr


_______________________________________________
dix mailing list
dix at ietf.org
https://www1.ietf.org/mailman/listinfo/dix