Re: [TLS] the use cases for GSS-based TLS and the plea for integrating

[pgut001 at cs.auckland.ac.nz]

Kyle Hamilton <aerowolf at gmail.com> writes:
> Why wouldn't the SSH paradigm work here?

You mean "connect to anything listening on port 22, then hand over your
password in the clear (inside the SSH tunnel)"?  How does it differ from the
current phishing-enabling TLS usage of "connect to anything listening on port
443, then hand over your password in the clear (inside the TLS tunnel)"?

(You're assuming that people check SSH key fingerprints.  Please cite a real-
world usability study supporting this assumption.  NB: That's a booby-trapped
question :-).

Peter.


_______________________________________________
TLS mailing list
TLS at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls