Subject: [saag] MESH Bar BOF Tues 19:10-21:00 in the IESG room Paraiso

From: Phillip Hallam-Baker <[email-masked]>
Date: Fri, 1 Apr 2016 17:19:31 -0400

People generally agree that usability is the biggest problem facing us
in security. Security that people don't use is useless.

The problem is harder than merely making secure applications as easy
to use as regular apps. If we are going to change people's behavior,
we have to make using the computer easier. Or at least make juggling
the many computers, mobiles, IoT devices etc. easy.

The Mathematical Mesh is a cryptographic infrastructure that allows a
user to create a personal profile and securely connect applications
and devices to it. All connections are authenticated bilaterally, end
to end and with a direct trust model (no trusted third party
required).

There is a cloud service involved but it is an untrusted service and
the user can switch to another any time they like (like a git
repository).

The tools are automated on the principle of 'don't give the user
instructions that can be replaced by code'.

When applications are connected, the user has the option of having the
profile management tool add in security. So when you connect Windows
Live Mail to a Mesh profile, the profile manager will automatically
turn on S/MIME. Right now the certs are self-signed but I am working
on getting it hooked up to the Comodo free cert issue.

All the code is open source under an MIT license and there are links
to the Internet Drafts and the demo videos on the following site:

http://cryptomesh.org/
[or http://prismproof.org/]

Right now the code has only been tested on Windows. But I am in the
middle of trying to get the GUI to work under GTK# which will
'allegedly' allow the code to run on OSX and Linux.

The first applications I want to get support for are SSH and a
WebPassword manager. The advantage of the latter over existing cloud
offerings being that it will be auditable.

I am also working on hooking up some IoT devices.