IETF Logo Mail Archive

Re: [Acme] ACME breaking change: Most GETs become POSTs

Adam Roach <adam@nostrum.com> Fri, 31 August 2018 20:52 UTC

Return-Path: <adam@nostrum.com>
X-Original-To: acme@ietfa.amsl.com
Delivered-To: acme@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DB6D1130E90 for <acme@ietfa.amsl.com>; Fri, 31 Aug 2018 13:52:15 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.88
X-Spam-Level:
X-Spam-Status: No, score=-1.88 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aEuqIEkUVzVb for <acme@ietfa.amsl.com>; Fri, 31 Aug 2018 13:52:14 -0700 (PDT)
Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 97FA7130E67 for <acme@ietf.org>; Fri, 31 Aug 2018 13:52:14 -0700 (PDT)
Received: from Svantevit.roach.at (99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id w7VKpO2k037016 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Fri, 31 Aug 2018 15:51:25 -0500 (CDT) (envelope-from adam@nostrum.com)
X-Authentication-Warning: raven.nostrum.com: Host 99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228] claimed to be Svantevit.roach.at
To: Jacob Hoffman-Andrews <jsha@eff.org>, Richard Barnes <rlb@ipv.sx>, "Salz, Rich" <rsalz@akamai.com>
Cc: IETF ACME <acme@ietf.org>, Felipe Gasper <felipe@felipegasper.com>
References: <c33184f3-4e64-b7ea-babb-d29e2307f1f3@eff.org> <2a889461-da9e-d3bd-e5a8-688eda61c614@eff.org> <51509028-1939-4851-8BB5-41F94FA146A1@felipegasper.com> <CAL02cgTLEMAMZQicNvXzQrRnGeemrUojmGe_8r=e_YZCNazdsQ@mail.gmail.com> <D171FC21-64FA-4438-AF45-520B5AFEEBF7@akamai.com> <CAL02cgQXx0fBUuxa8ivwTk09J5h8tWiNP8b+8taY8wPJxLypeA@mail.gmail.com> <4404d740-504c-bba7-d30d-dff385bd1216@eff.org> <02333187-cb4e-7e4c-b035-1fd311b437f0@eff.org>
From: Adam Roach <adam@nostrum.com>
Message-ID: <a0475664-b408-f1e0-0330-25b52d503dd8@nostrum.com>
Date: Fri, 31 Aug 2018 15:51:18 -0500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.0
MIME-Version: 1.0
In-Reply-To: <02333187-cb4e-7e4c-b035-1fd311b437f0@eff.org>
Content-Type: text/plain; charset="utf-8"; format="flowed"
Content-Transfer-Encoding: 7bit
Content-Language: en-US
Archived-At: <https://mailarchive.ietf.org/arch/msg/acme/2yIDnpF42flN1K_EXIWHRhPNFZw>
Subject: Re: [Acme] ACME breaking change: Most GETs become POSTs
X-BeenThere: acme@ietf.org
X-Mailman-Version: 2.1.27
Precedence: list
List-Id: Automated Certificate Management Environment <acme.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/acme>, <mailto:acme-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/acme/>
List-Post: <mailto:acme@ietf.org>
List-Help: <mailto:acme-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/acme>, <mailto:acme-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 31 Aug 2018 20:52:23 -0000

On 8/31/18 3:14 PM, Jacob Hoffman-Andrews wrote:
> That winds up leaving us pretty close to being back at draft-14: Since 
> POST-as-GET protects resource bodies, and the currently-specified 
> resources are already broken down into sensitive (account) and not 
> (orders, authorizations, challenges, certificates), we could just as 
> well leave the non-sensitive resources as regular GETs.


No.


The baseline problem here is that the original analysis that determined 
that orders, authorizations, challenges, and certificates were "not 
sensitive" was incorrect. These are all potentially sensitive from a 
privacy perspective. Perhaps not in isolation, but the problem here is 
correlation, not isolation.

/a

v2.23.0 | Report a Bug | By Email