Re: [apps-discuss] Webfinger discussion

[Peter Saint-Andre <[e-mail]>]

On 3/26/12 8:31 PM, Bob Wyman wrote:
> 
> 
> On Mon, Mar 26, 2012 at 11:05 AM, Andrew Sullivan
> <[e-mail] <mailto:[e-mail]>> wrote:
> 
>     On Mon, Mar 26, 2012 at 10:35:54AM -0400, Paul E. Jones wrote:
> 
>     > > Andrew Sullivan: when I was a kid, they told us to turn off
>     finger, so I'm
>     > > concerned about security
>     >
>     > That was due to the fact the finger protocol implementations had
>     security
>     > holes.  It was also possible to do things like "ln /etc/password
>     .plan" and
>     > that was a bad thing :-)
> 
>     That wasn't the only reason they told us this.  One of the things that
>     people used to worry about was that finger leaked information.  In
>     particular, it was an excellent way to identify targets for account
>     takeover: people who never logged in, and people who were in for
>     endless days and therefore whose account was probably often
>     unmonitored.
> 
> WebFinger has primarily been used for providing access to relatively
> static data rather than for the kind of dynamic "presence" information
> that finger was often used for. Thus, when folk are thinking about
> WebFinger, they are usually considering use cases like "locating a
> user's blog," or "finding a user's public key." However, there isn't
> anything in WebFinger that would prevent providing dynamic data such as
> "current location (lat/long)," "logged in state," or even "last command
> issued to bash..." (highly un-recommended!). If people did, in fact, use
> WebFinger to record such stuff, the concerns you mentioned would be
> relevant. Thus, it might make sense for the Security Considerations
> section to suggest that one should think carefully before using
> WebFinger to provide such dynamic information.

We already have protocols for such dynamic publish/subscribe features
(and those protocols include ways to authorize who can see what).
Webfinger might provide pointers to locations where one could subscribe
to dynamic data, but AFAIK it would not be used to pull the data.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/