Subject: [gaia] practical considerations about security implementation

From: Daniel Formolo <[email-masked]>
Date: Thu, 6 Aug 2015 13:42:35 -0300

Dears, I read "Human Rights Protocol Considerations Glossary
draft-dkg-hrpc-glossary-00", it seems good, but I have some technical
considerations. We can work hard implementing new features in protocols to
improve connectivity (interoperability, resilience, reliability,
robustness). That is feasible.

But, security (resilience, reliability, confidentiality, anonymity,
authenticity), is in general broken in application layer. Most cases people
uses final software insecurely. I am afraid that much technical effort will
put to improve security in middleware but most of security problems will
continues due to wrong use of software by people. Maybe the focus to
security at first moment must be in application layer and good patterns of
final software to avoid people get mistakes.

kind regards.

Daniel Formolo.

---

From: "Eggert, Lars" <[email-masked]>
Date: Fri, 7 Aug 2015 07:43:15 +0000

CC'ing [email-masked] and setting reply-to

On 2015-08-06, at 18:42, Daniel Formolo <[email-masked]> wrote:
> 
> Dears, I read "Human Rights Protocol Considerations Glossary draft-dkg-hrpc-glossary-00", it seems good, but I have some technical considerations. We can work hard implementing new features in protocols to improve connectivity (interoperability, resilience, reliability, robustness). That is feasible.
> 
> But, security (resilience, reliability, confidentiality, anonymity, authenticity), is in general broken in application layer. Most cases people uses final software insecurely. I am afraid that much technical effort will put to improve security in middleware but most of security problems will continues due to wrong use of software by people. Maybe the focus to security at first moment must be in application layer and good patterns of final software to avoid people get mistakes.
> 
> 
> kind regards.
> 
> Daniel Formolo.
> _______________________________________________
> gaia mailing list
> [email-masked]
> https://irtf.org/mailman/listinfo/gaia