Subject: Re: [saag] stopping (https) phishing

From: Henry Story <[email-masked]>
Date: Fri, 12 Oct 2018 09:49:33 +0200

Hi all,

Just following up on the July thread a bit. Has anything come of the idea of an RG for this?

I ask as I have been full time reading up on category theory and (modal) logic for  my
second year PhD report which I need to defend in 2 weeks now. So I finally have a bit of 
time to breathe.

	Here is a presentation I gave on the topic at the International Semantic Web Conference that
was held in Monterey this week. 

    https://youtu.be/_-hy5WKMg2g <https://youtu.be/_-hy5WKMg2g>

It also explains the architecture of the SoLiD project which Tim Berners Lee's startup https://www.inrupt.com/ <https://www.inrupt.com/> ,
and which you may have seen in the news.

Henry Story

> On 23 Jul 2018, at 21:50, Nalini J Elkins <[email-masked] <mailto:[email-masked]>> wrote:
> 
> 
> 
> 
> > I think it would be great if we could organize some sort of Bar BOF or even less formal get together to talk about this. Maybe just stay late in one of the room one night???
> 
> Sure.  I am working with some of the enterprises to get some concrete examples of what has worked, what has not, and other concerns.
> 
> We can maybe even meet in an actual bar!   Let's discuss more as time approaches.
> 
> Thanks,
> Bret
> PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
> "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."
> 
>> On Jul 23, 2018, at 10:09 AM, Nalini J Elkins <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> I am willing to help also.
>> 
>> 
>> This is an important problem for enterprises.  You may be familiar with the OPM data breach which was most likely started by a phishing attack.
>> 
>> https://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach <https://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach>
>> 
>> I wonder if we want to have some type of meeting in Bangkok.
>> Thanks,
>> 
>> Nalini Elkins
>> CEO and Founder
>> Inside Products, Inc.
>> www.insidethestack.com <http://www.insidethestack.com/>
>> (831) 659-8360
>> 
>> 
>> 
>> ________________________________
>> From: Tim Hollebeek <[email-masked]>
>> To: Adam Montville <[email-masked]>; John R. Levine <[email-masked]> 
>> Cc: "[email-masked]" <[email-masked]>
>> Sent: Monday, July 23, 2018 8:56 AM
>> Subject: Re: [saag] stopping (https) phishing
>> 
>> 
>> 
>> I'd help, too.  This is an important problem.  I think I would favor a RG because
>> I haven't seen any ideas proposed yet that would have a significant impact on
>> the problem, though some people seem to be thinking along the right directions.
>> It's a tough problem.
>> 
>> -Tim
>> 
>> 
>>> -----Original Message-----
>>> From: saag <[email-masked]> On Behalf Of Adam Montville
>>> Sent: Sunday, July 22, 2018 8:05 AM
>>> To: John R. Levine <[email-masked]>
>>> Cc: [email-masked]
>>> Subject: Re: [saag] stopping (https) phishing
>>> 
>>> Whether a WG or an RG, I’d be interested in helping here.
>>> 
>>> On Jul 21, 2018, at 8:00 PM, John R. Levine <[email-masked]> wrote:
>>> 
>>>>> I for one would really like to see the IETF setup a working group for this
>>> specific topic, it would be good to work through this and find a solution that
>>> works. I would be willing to help out here and will dedicate time to this effort.
>>>> 
>>>> I don't think there is enough stuff here to merit WG.  Perhaps talk to the IRTF
>>> about an RG to explore ideas not ready to standardize.
>>>> 
>>>> 
>>>>> 
>>>>> Bret
>>>>> 
>>>>> Sent from my Commodore 128D
>>>>> 
>>>>> PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
>>>>> 
>>>>>> On Jul 21, 2018, at 2:40 PM, John R. Levine <[email-masked]> wrote:
>>>>>> 
>>>>>> On Sat, 21 Jul 2018, Henry Story wrote:
>>>>>>>> How would this IWoT differ from what CAs were supposed to do?
>>>>>>> 
>>>>>>> That is easy. IWoT would be based on institutions that tie into
>>>>>>> nation or region based local registries that tie into national anchors that
>>> may tie into federal ones (as in the USA, or Germany).
>>>>>> 
>>>>>> This sounds a lot like the industry-specific CAs I proposed, only this
>>> depends on a great deal of software that does not exist and probably never
>>> will.
>>>>>> 
>>>>>> R's,
>>>>>> John
>>>>>> 
>>>>>> _______________________________________________
>>>>>> saag mailing list
>>>>>> [email-masked]
>>>>>> https://www.ietf.org/mailman/listinfo/saag
>>>>> 
>>>> 
>>>> Regards,
>>>> John Levine, [email-masked], Primary Perpetrator of "The Internet for
>>>> Dummies", Please consider the environment before reading this e-mail.
>>>> https://jl.ly
>>>> 
>>>> _______________________________________________
>>>> saag mailing list
>>>> [email-masked]
>>>> https://www.ietf.org/mailman/listinfo/saag
>>> 
>>> _______________________________________________
>>> saag mailing list
>>> [email-masked]
>>> https://www.ietf.org/mailman/listinfo/saag
>> _______________________________________________
>> saag mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/saag
>> 
>> _______________________________________________
>> saag mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/saag
> 
> 
> 
> 
> _______________________________________________
> saag mailing list
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/saag

---

From: Kirsty P <[email-masked]>
Date: Fri, 12 Oct 2018 12:55:48 +0000

Henry,

Yes, it has! We've proposed the SMART RG (Stopping Malware and Researching Threats): https://www.irtf.org/mailman/listinfo/smart

We're having a planning meeting in Bangkok (time/date TBC), so please subscribe to the list for updates, comment on the problems and the charter that we've posted there, and contribute your ideas!

Kirsty

________________________________
From: saag <[email-masked]> on behalf of Henry Story <[email-masked]>
Sent: 12 October 2018 08:49:33
To: [email-masked]
Subject: Re: [saag] stopping (https) phishing

Hi all,

    https://youtu.be/_-hy5WKMg2g<https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fyoutu.be%2F_-hy5WKMg2g&data=02%7C01%7Ckirsty.p%40ncsc.gov.uk%7C691a6ca0a242441396cb08d6301755f7%7C14aa5744ece1474ea2d734f46dda64a1%7C0%7C0%7C636749274132779843&sdata=qTjuhyNgFeNfsrSdX6jErfyrql1gK2Q6ByJ1mCI9Hf8%3D&reserved=0>

It also explains the architecture of the SoLiD project which Tim Berners Lee's startup https://www.inrupt.com/<https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.inrupt.com%2F&data=02%7C01%7Ckirsty.p%40ncsc.gov.uk%7C691a6ca0a242441396cb08d6301755f7%7C14aa5744ece1474ea2d734f46dda64a1%7C0%7C0%7C636749274132789860&sdata=Z8Qq0CD2Fsii1HzVrCBxvX7SD2V4sEj8YyXiYP%2BQ6Xw%3D&reserved=0> ,
and which you may have seen in the news.

Henry Story

Thanks,
Bret

On Jul 23, 2018, at 10:09 AM, Nalini J Elkins <[email-masked]<mailto:[email-masked]>> wrote:

https://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach<https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fen.wikipedia.org%2Fwiki%2FOffice_of_Personnel_Management_data_breach&data=02%7C01%7Ckirsty.p%40ncsc.gov.uk%7C691a6ca0a242441396cb08d6301755f7%7C14aa5744ece1474ea2d734f46dda64a1%7C0%7C0%7C636749274132799869&sdata=5e1XAHuNjwdCKVTWAcPY0lf9J6VqvWxzGPMbccd4z04%3D&reserved=0>

Nalini Elkins
CEO and Founder
Inside Products, Inc.
www.insidethestack.com<https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.insidethestack.com%2F&data=02%7C01%7Ckirsty.p%40ncsc.gov.uk%7C691a6ca0a242441396cb08d6301755f7%7C14aa5744ece1474ea2d734f46dda64a1%7C0%7C0%7C636749274132799869&sdata=x%2BL43q8c2E9Qzw92CygJt9fZDGqkuuxv2NdYqM7mBKI%3D&reserved=0>
(831) 659-8360

________________________________
From: Tim Hollebeek <[email-masked]<mailto:[email-masked]>>
To: Adam Montville <[email-masked]<mailto:[email-masked]>>; John R. Levine <[email-masked]<mailto:[email-masked]>>
Cc: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Sent: Monday, July 23, 2018 8:56 AM
Subject: Re: [saag] stopping (https) phishing

-Tim

-----Original Message-----
From: saag <[email-masked]<mailto:[email-masked]>> On Behalf Of Adam Montville
Sent: Sunday, July 22, 2018 8:05 AM
To: John R. Levine <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [saag] stopping (https) phishing

On Jul 21, 2018, at 8:00 PM, John R. Levine <[email-masked]<mailto:[email-masked]>> wrote:

Bret

On Jul 21, 2018, at 2:40 PM, John R. Levine <[email-masked]<mailto:[email-masked]>> wrote:

R's,
John

_______________________________________________
saag mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/saag

Regards,
John Levine, [email-masked]<mailto:[email-masked]>, Primary Perpetrator of "The Internet for
Dummies", Please consider the environment before reading this e-mail.
https://jl.ly<https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fjl.ly&data=02%7C01%7Ckirsty.p%40ncsc.gov.uk%7C691a6ca0a242441396cb08d6301755f7%7C14aa5744ece1474ea2d734f46dda64a1%7C0%7C0%7C636749274132809870&sdata=uuNMUAn27EIHiMzw4uBYZKH%2FvaxlxzR3S%2BOvcNrcN%2FY%3D&reserved=0>

_______________________________________________
saag mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/saag
_______________________________________________
saag mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/saag

_______________________________________________
saag mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/saag<https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fsaag&data=02%7C01%7Ckirsty.p%40ncsc.gov.uk%7C691a6ca0a242441396cb08d6301755f7%7C14aa5744ece1474ea2d734f46dda64a1%7C0%7C0%7C636749274132819883&sdata=ilRFxzoE7dVFkXcQpag1eh5GdGrVZHg%2FIQiD3dI8%2Bo0%3D&reserved=0>

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to [email-masked]

---

From: Kathleen Moriarty <[email-masked]>
Date: Fri, 12 Oct 2018 08:58:20 -0400

Sent from my mobile device

On Jul 21, 2018, at 9:00 PM, John R. Levine <[email-masked]> wrote:

>> I for one would really like to see the IETF setup a working group for this specific topic, it would be good to work through this and find a solution that works. I would be willing to help out here and will dedicate time to this effort.
> 
> I don't think there is enough stuff here to merit WG.  Perhaps talk to the IRTF about an RG to explore ideas not ready to standardize.
> 
> 

This would be a good fit for SMART, a proposed research group that casts a wider net.

Best regards,
Kathleen 

>>>> That is easy. IWoT would be based on institutions that tie into nation or region based local
>>>> registries that tie into national anchors that may tie into federal ones (as in the USA, or Germany).
>>> 
>>> This sounds a lot like the industry-specific CAs I proposed, only this depends on a great deal of software that does not exist and probably never will.
>>> 
>>> R's,
>>> John
>>> 
> John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
> Please consider the environment before reading this e-mail. https://jl.ly
>

---

From: Story H.J. <[email-masked]>
Date: Thu, 11 Oct 2018 09:27:53 +0000

Hi all,

    https://youtu.be/_-hy5WKMg2g

It also explains the architecture of the SoLiD project which Tim Berners Lee's startup https://www.inrupt.com/ ,
and which you may have seen in the news.

Henry Story

Thanks,
Bret

https://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach

Nalini Elkins
CEO and Founder
Inside Products, Inc.
www.insidethestack.com<http://www.insidethestack.com>
(831) 659-8360

-Tim

-----Original Message-----
From: saag <[email-masked]> On Behalf Of Adam Montville
Sent: Sunday, July 22, 2018 8:05 AM
To: John R. Levine <[email-masked]>
Cc: [email-masked]
Subject: Re: [saag] stopping (https) phishing

Bret

R's,
John

Regards,