Re: [Captive-portals] Secdir last call review of draft-ietf-capport-api-07

Barry Leiba <> Thu, 30 April 2020 15:40 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 06F043A0CDF; Thu, 30 Apr 2020 08:40:41 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.218
X-Spam-Status: No, score=-2.218 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.25, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.25, RCVD_IN_MSPIKE_H2=-0.82, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id ZfJfTVvVA4hl; Thu, 30 Apr 2020 08:40:38 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 9107D3A0B14; Thu, 30 Apr 2020 08:39:47 -0700 (PDT)
Received: by with SMTP id y26so1944944ioj.2; Thu, 30 Apr 2020 08:39:47 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=4ZPn8oZxRek3r3eFYswS8goQLxk7/Ikc4DUUG3AF61M=; b=RbMorXGeQrU5rIt9bi6QxYTV+os6lQkWDMRzurNzaKNM1IhaLB/77OeGF5ZtKzWWxY wjRlrukASFTRIJF73F6/RZE8Raw1UmKb1r6OgbVdrmRs+vzLyGF1mUCE8lET4ulTmWco hjyllIeyD9eKLuEAkTDBXzgWcLjJm635O2B/KnENvcHhyzYu3q4fwoyla3VLSjRHWJx0 BatKVdVR2blsW5iR15MX7Dds1DtUxIrOIJW1SvGCE9IebBhyaNDzsXmkv3dbNZXnqkTD QBfE5iAP/TjMvzIk7+Rqj1qKsC54ul33GRnfdKbhvpLXdPy424mSxACEcmArYkrFET4A IUiQ==
X-Gm-Message-State: AGi0PubNZ+ZMVyCO8tZZmxNjksKvCEl6HGPNATBflImy9sSJd9q1W1x6 jGSz6omeJ38Pyb8UdToEgFpWAdUNRN216quVfAhAnXCl
X-Google-Smtp-Source: APiQypIvkwWZsuMah0vY30MVbV99KxoiH2h09C1BQt/UIGgrcqQoi5P6MiQYOnNks3ispvsq+mOayc6FtIj6l7g8HMM=
X-Received: by 2002:a5e:8613:: with SMTP id z19mr2430811ioj.84.1588261186591; Thu, 30 Apr 2020 08:39:46 -0700 (PDT)
MIME-Version: 1.0
References: <>
In-Reply-To: <>
From: Barry Leiba <>
Date: Thu, 30 Apr 2020 11:39:35 -0400
Message-ID: <>
To: Robert Sparks <>
Cc: IETF SecDir <>,,,
Content-Type: text/plain; charset="UTF-8"
Archived-At: <>
Subject: Re: [Captive-portals] Secdir last call review of draft-ietf-capport-api-07
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Discussion of issues related to captive portals <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 30 Apr 2020 15:40:46 -0000

Thanks for the review, Robert.


On Thu, Apr 30, 2020 at 11:00 AM Robert Sparks via Datatracker
<> wrote:
> Reviewer: Robert Sparks
> Review result: Ready
> I have reviewed this document as part of the security directorate's ongoing
> effort to review all IETF documents being processed by the IESG. These comments
> were written primarily for the benefit of the security area directors. Document
> editors and WG chairs should treat these comments just like any other last call
> comments.
> This document is ready for publication as Proposed Standard RFC.
> The document defines an HTTP json-based API for clients to use with a captive
> portal API server. Discovery of the API server URL is defined in other capport
> documents. Connection to the server uses TLS. Server authentication SHOULD use
> OCSP stapling, and the network SHOULD provide permit connection to NTP servers
> (or other time-sync mechanisms). The security considerations section calls out
> the potential risk of look-alike characters being used in the server domain
> name to mislead the user of the client of this API.