Re: [Aggsrv] updated charter proposal

[Salvatore Loreto <[e-mail]>]

On 2/27/13 8:23 PM, Paul E. Jones wrote:
>> >1) Security - it still seems to me that there is a fundamental
>> >difference in security "contexts" here. In particular, the aggsrv
>> >information must only be given out to the actual "owner" of the account.
>> >The webfinger spec does have a section on access control, aggsrv would
>> >need to have much stronger language. At the very least I think you
>> >should change Section 3.3 of webfinger to include an example of an
>> >authenticated HTTP request and point out in the text that authentication
>> >is required.
> It's mentioned in the WebFinger spec (or is supposed to be) that linked
> resources might require their own authentication.  For mail server
> configuration, for example, I can fully appreciate that one might use a TLS
> connection to some other URI and use basic authentication with the user's
> email server user ID and password for authentication.  The response might be
> some JSON object that contains all of the config data.
>
just a question... how this related with the decision that WebFinger 
MUST run
on TLS?

cheers
/Salvatore