On 06.09.2013 04:36, Brian E Carpenter wrote:
I'm not saying there's no issue or no work to do, but what's new about any of this?
Still at the end of last year I remember conversations in working groups that questions why we need TLS security for protocols like SCIM (a protocol that shuffles credentials around).
I don't think that the decision in the RTCWeb group against SDES would have been possible without the NSA news.
I also remember the Internet Privacy workshop the IAB and others organized about 2 years ago and back then we argued whether government surveillance is something we should focus on or whether we are mainly interested in companies who impact your privacy.
While some (many) have already anticipated that the NSA (and other governments) deploy massive surveillance technologies the extend to which it is done has surprised most security persons I know.
In a nutshell, the understanding and awareness of the wider Internet community has changed with those news.
Ciao Hannes