Re: RFC2616 vs RFC2617, was: Straw-man charter for http-bis

["tom.petch" <[e-mail]>]

<inline>
Tom Petch

----- Original Message -----
From: "Adrien de Croy" <[e-mail]>
To: "Mark Nottingham" <[e-mail]>
Cc: "Apps Discuss" <[e-mail]>rg>; <[e-mail]>
Sent: Wednesday, June 13, 2007 12:16 AM
Subject: Re: RFC2616 vs RFC2617, was: Straw-man charter for http-bis

>
> my experience also is that it is extremely rare to encounter public web
> servers that use any HTTP auth mechanism.
>
> NTLM and Basic auth is often used for intranets, and proxy access.
>
> I've never seen an instance of Digest auth.
>
> Seems to me that the issue of securing communications and authenticating
> or identifying parties are closely aligned, why not just have some form
> of auth built into TLS, then we could use it for any protocol that can
> use TLS, instead of having to implement separate auth schemes for every
> higher protocol.
>
TLS can do that but it does not gel with the way in which (many) organisations
are structured.  Those responsible for security, for security credentials and
their maintenance, do not want to be ferreting around in the depths of a network
stack, they prefer working at application and database level, a point that has
already been alluded to in this thread.

The solution I like to this is channel bindings, as promoted by Nico Williams,
where a weakly authenticated tunnel is set up and then stronger
authentication - which can rely on the strong encryption which is now in place -
is performed via it, eg at application level in the stack.

>
> Mark Nottingham wrote:
> >
> > On 08/06/2007, at 6:10 PM, Stephane Bortzmeyer wrote:
> >
> >> On Thu, Jun 07, 2007 at 06:18:13PM +0200,
> >>  Julian Reschke <[e-mail]> wrote
> >>  a message of 14 lines which said:
> >>
> >>> In the wild, most authentication isn't using RFC2617 anyway.
> >>
> >> Any data here? IMHO, this assertion is not true, unless you limit to
> >> big e-commerce Web sites. For instance, HTTP-based Web services use
> >> 2617.
> >
> > My experience is that it isn't adequate for even those purposes, in
> > many cases.
> >
> > --
> > Mark Nottingham     http://www.mnot.net/