Re: [appsdir] Scans for draft-ietf-tokbind-protocol and draft-ietf-tokbind-https

FYI, I've been paying attention to these.  They certainly need a lot
of attention.  I have suggested several changes that - if they are
accepted - will completely change the structure of the two drafts.
One of those proposed changes is a merge of the drafts.  The authors
have accepted the need to change the negotiation portion in -protocol
entirely.

Attention is definitely warranted, but some delay might avoid some churn.

On 7 April 2015 at 17:15, Ted Hardie <ted.ietf@gmail.com> wrote:
> draft-ietf-tokbind-protocol will need significant attention, especially from
> folks with application security, privacy,  and web services backgrounds.
> Though the draft isn't very long, it describes a general method of binding
> application security tokens to a channel and reusing them with a server as
> well as methods for taking those issued by one server and using them
> elsewhere.  The interaction between the binding and application semantics
> will likely be a focus of reviews, as would be the privacy implication of a
> long-lived token of this type (though the draft presumes the ability to
> clear state, it's not at all clear that this would be available to mobile
> apps or similar).
>
> draft-ietf-tokbind-https will need a similar amount of attention, especially
> from folks familiar with HTTP semantics (headers and status code semantics
> being two areas of concern).  In essence, this is the worked example of the
> protocol, embodied in HTTP.
>
> regards,
>
> Ted
>
> _______________________________________________
> appsdir mailing list
> appsdir@ietf.org
> https://www.ietf.org/mailman/listinfo/appsdir
>