IAB-PrivSec-program / draft-iab-privsec-confidentiality-mitigations

The Internet Draft recording the program's draft on mitigating confidentiality threats
0 stars 3 forks source link

Missing discussion of impact to deployed protocols #14

Open martinthomson opened 8 years ago

martinthomson commented 8 years ago

Changes to an existing protocol to improve privacy and security properties can lead to conflicts with deployments. Existing users of the protocol might rely on the protocol being the way it is.

Take the concerns with SNI in TLS. This is almost a paragon example of something that would fit the minimization/encryption criteria outlined in this document. However, the TLS ecosystem has evolved to rely on SNI being in the clear to the point that a general solution to the problem is basically intractable.

This is a problem that needs to be properly acknowledged, probably also in relation to #13.