Re: [Captive-portals] The architecture requiring that the API be secure

Michael Richardson <mcr@sandelman.ca> Wed, 28 February 2018 22:26 UTC

From: Michael Richardson <mcr@sandelman.ca>
To: Kyle Larose <klarose@sandvine.com>
cc: "captive-portals@ietf.org" <captive-portals@ietf.org>
In-Reply-To: <9ba69a5cfa1342769eb703727b2402fb@sandvine.com>
References: <9ba69a5cfa1342769eb703727b2402fb@sandvine.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <16653.1519856766.1@obiwan.sandelman.ca>
Date: Wed, 28 Feb 2018 17:26:06 -0500
Message-ID: <16654.1519856766@obiwan.sandelman.ca>
Archived-At: <https://mailarchive.ietf.org/arch/msg/captive-portals/W-EYJ42xUgY_8GjiJv4Q944n7vg>
Subject: Re: [Captive-portals] The architecture requiring that the API be secure
Precedence: list

Kyle Larose <klarose@sandvine.com> wrote:
    > Issue #6 in the architecture draft
    > (https://github.com/capport-wg/architecture/issues/6) was raised to
    > point out that we should really mandate that the API be secure.

I entered some comments on the github issue.

    > Basically, we want to make TLS a requirement, not a suggestion, so I've
    > changed the wording around TLS to reflect this. I also added a section
    > to the security section discussing the motivation behind the
    > requirement.

I think that we have to deal with Martin's points about all the ways that the
certificate behind HTTPS can be broken.  I don't want to see overrides for
that certificate.

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        | network architect  [
]     mcr@sandelman.ca  http://www.sandelman.ca/        |   ruby on rails    [

[Captive-portals] The architecture requiring that… Kyle Larose
Re: [Captive-portals] The architecture requiring … Michael Richardson