Re: [art] New Version Notification for draft-nottingham-how-did-that-get-into-the-repo-00.txt

[Mark Nottingham <[e-mail]>]

Thanks for the feedback!

> On 19 Aug 2018, at 6:06 pm, Martin J. Dürst <[e-mail]> wrote:
> 
> On 2018/08/16 14:28, Mark Nottingham wrote:
>> FYI, an idea to help prevent accidental disclosure of authentication tokens. Thoughts? I've circulated it some had had a generally positive response.
>> Prettier copy at:
>>   https://mnot.github.io/I-D/how-did-that-get-into-the-repo/
> 
> A few thoughts:
> 
> - Overall, worth a try.
> 
> - Some people may want to use base64 for these tokens.
>  What about allowing '+', '=' (both of these can appear
>  in path elements, or just use pchar and get all of sub-delims,
>  and pct-encoded on top of that).
>  What about also allowing '/'? This is a bit tricky, but should
>  work out because relative secret-token URIs (i.e. without the
>  scheme) will defeat the whole purpose of the scheme anyway.

pchar seems reasonable. 

> - Please make sure you say that UTF-8 is used for non-ASCII characters
>  in %-escaping. Please see the last paragraph of Section 2 of RFC 3986.
>  While I don't expect too many non-ASCII characters in security tokens,
>  it's better to be on the safe side.

Done.

> - Committing software that checks for the absence of "secret-token" URIs
>  may be difficult. The trick is to artificially compose the string
>  "secret-token" in the software, e.g. as "secret" + "-token".

I leave this as an exercise for the reader...


> 
> Regards,    Martin.
> 
>> Cheers,
>>> Begin forwarded message:
>>> 
>>> From: [e-mail]
>>> Subject: New Version Notification for draft-nottingham-how-did-that-get-into-the-repo-00.txt
>>> Date: 16 August 2018 at 3:27:14 pm AEST
>>> To: "Mark Nottingham" <[e-mail]>
>>> 
>>> 
>>> A new version of I-D, draft-nottingham-how-did-that-get-into-the-repo-00.txt
>>> has been successfully submitted by Mark Nottingham and posted to the
>>> IETF repository.
>>> 
>>> Name:		draft-nottingham-how-did-that-get-into-the-repo
>>> Revision:	00
>>> Title:		The secret-token URI Scheme
>>> Document date:	2018-08-16
>>> Group:		Individual Submission
>>> Pages:		5
>>> URL:            https://www.ietf.org/internet-drafts/draft-nottingham-how-did-that-get-into-the-repo-00.txt
>>> Status:         https://datatracker.ietf.org/doc/draft-nottingham-how-did-that-get-into-the-repo/
>>> Htmlized:       https://tools.ietf.org/html/draft-nottingham-how-did-that-get-into-the-repo-00
>>> Htmlized:       https://datatracker.ietf.org/doc/html/draft-nottingham-how-did-that-get-into-the-repo
>>> 
>>> 
>>> Abstract:
>>>   This document registers the "secret-token" URI scheme, to aid in the
>>>   identification of authentication tokens.
>>> 
>>> 
>>> 
>>> 
>>> Please note that it may take a couple of minutes from the time of submission
>>> until the htmlized version and diff are available at tools.ietf.org.
>>> 
>>> The IETF Secretariat
>>> 
>> --
>> Mark Nottingham   https://www.mnot.net/

--
Mark Nottingham   https://www.mnot.net/