Re: [TLS] Security today

[Mike <mike-list at pobox.com>]

Michael Howard wrote:
> I think there is a deeper issue than this - people email
> sensitive data all the time with no encryption...

Yes, email security is problematic, but users have to do
a lot of manual configuration even to get set up for it.
And then, they need to convince their correspondents to
set up their system too.

With HTTPS, the infrastructure is already there, and it's
being used.  The problem is with server configuration:
key size, cipher suite selection.  If servers were simply
better configured, security would automatically improve.
Users wouldn't have to do anything differently; those
who we rely on for security are failing us!

Mike

P.S. and there's nothing you or I can do about it as a
user -- we can't influence the key sizes or cipher suites
offered by a server -- it's either take it or leave it.
_______________________________________________
TLS mailing list
TLS at ietf.org
https://www.ietf.org/mailman/listinfo/tls