Re: [apps-discuss] Webfinger discussion

On Mon, Mar 26, 2012 at 11:05 AM, Andrew Sullivan <ajs@anvilwalrusden.com>wrote:

> On Mon, Mar 26, 2012 at 10:35:54AM -0400, Paul E. Jones wrote:
>
> > > Andrew Sullivan: when I was a kid, they told us to turn off finger, so
> I'm
> > > concerned about security
> >
> > That was due to the fact the finger protocol implementations had security
> > holes.  It was also possible to do things like "ln /etc/password .plan"
> and
> > that was a bad thing :-)
>
> That wasn't the only reason they told us this.  One of the things that
> people used to worry about was that finger leaked information.  In
> particular, it was an excellent way to identify targets for account
> takeover: people who never logged in, and people who were in for
> endless days and therefore whose account was probably often
> unmonitored.
>
WebFinger has primarily been used for providing access to relatively static
data rather than for the kind of dynamic "presence" information that finger
was often used for. Thus, when folk are thinking about WebFinger, they are
usually considering use cases like "locating a user's blog," or "finding a
user's public key." However, there isn't anything in WebFinger that would
prevent providing dynamic data such as "current location (lat/long),"
"logged in state," or even "last command issued to bash..." (highly
un-recommended!). If people did, in fact, use WebFinger to record such
stuff, the concerns you mentioned would be relevant. Thus, it might make
sense for the Security Considerations section to suggest that one should
think carefully before using WebFinger to provide such dynamic information.

>
> Now, I never knew whether I believed this sort of complaint, but it
> was one, and the draft as it stands only just hints at the sort of
> analysis that ought to be done.  It seems like this requires a much
> expanded security considerations section, and that was the point I
> wanted to make.
>
> Best,
>
> A
>
> --
> Andrew Sullivan
> ajs@anvilwalrusden.com
> _______________________________________________
> apps-discuss mailing list
> apps-discuss@ietf.org
> https://www.ietf.org/mailman/listinfo/apps-discuss
>