In 1996, the IAB and IESG recognized that the growth of the Internet depended on users having confidence that the network would protect their private information. RFC 1984 documented this need. Since that time, we have seen evidence that the capabilities and activities of attackers are greater and more pervasive than previously known. The IAB now believes it is important for protocol designers, developers, and operators to make encryption the norm for Internet traffic. Encryption should be authenticated where possible, but even protocols providing confidentiality without authentication are useful in the face of pervasive surveillance as described in RFC 7258.
Newly designed protocols should prefer encryption to cleartext operation. There may be exceptions to this default, but it is important to recognize that protocols do not operate in isolation. Information leaked by one protocol can be made part of a more substantial body of information by cross-correlation of traffic observation. There are protocols which may as a result require encryption on the Internet even when it would not be a requirement for that protocol operating in isolation.
We recommend that encryption be deployed throughout the protocol stack since there is not a single place within the stack where all kinds of communication can be protected.
The IAB urges protocol designers to design for confidential operation by default. We strongly encourage developers to include encryption in their implementations, and to make them encrypted by default. We similarly encourage network and service operators to deploy encryption where it is not yet deployed, and we urge firewall policy administrators to permit encrypted traffic.
We believe that each of these changes will help restore the trust users must have in the Internet. We acknowledge that this will take time and trouble, though we believe recent successes in content delivery networks, messaging, and Internet application deployments demonstrate the feasibility of this migration. We also acknowledge that many network operations activities today, from traffic management and intrusion detection to spam prevention and policy enforcement, assume access to cleartext payload. For many of these activities there are no solutions yet, but the IAB will work with those affected to foster development of new approaches for these activities which allow us to move to an Internet where traffic is confidential by default.
Category Archives: Internet
Google released 750 new icons for phones and tablets that will undoubtedly take over the world. They’re free for anyone to use.
(Click above for a larger image of a some of them.) Cory Doctorow thinks this move by Google is great, and one disagrees with Cory at one’s peril since he’s usually right.
I suppose it’s language-independent and transnational. I can’t help but think, though, that the task of memorizing the meanings for these pictures will be akin to learning Chinese.
Wasn’t the move from pictograms to the alphabet supposed to be a triumph of civilization?
Oh, joy: despite a vigorous round of patching, Shellshock isn’t dead, and isn’t even resting:
Google security researcher Michal "lcamtuf" Zalewski has disclosed to iTnews that over the past two days he has discovered two previously unaddressed issues in the Bash function parser, one of which is as bad as the original Shellshock vulnerability.
"The first one likely permits remote code execution, but the attack would require a degree of expertise to carry out," Zalewski said.
"The second one is essentially equivalent to the original flaw, trivially allowing remote code execution even on systems that deployed the fix for the initial bug," he added.
Dog.ma resolves, but isn’t interesting. Opti.ma is parked, which almost seems appropriate.
Enig.ma doesn’t resolve, which also seems appropriate, and it isn’t available. And neither are mag.ma and dra.ma.
Look.ma exists but is boring.
Ma.ma doesn’t resolve and isn’t available. Nor is Kar.ma.
Nor even meh.ma.
OK, back to work now.
Seems like every time the Miami-Dade Public Library system has a computer upgrade, their nifty search plugin gets lost in the shuffle. The MDPLS website recently had a major face-lift, with equivocal results on the desktop, but a much better look on my cell phone. And yes, again, the link to the search plugin vanished. And again I wrote in to complain. And again they were very very courteous in replying — I got three emails in less than two weeks, each apologizing for the delay in resolving the issue.
This is the same library system whose budget the Mayor keeps slashing by the way. The library is one of the rare cultural successes of Miami-Dade county — and if you live here MDPLS deserves your support.