Re: [dispatch] [RAI] MSRP Expert Review of draft-pd-dispatch-msrp-websocket-04

I don’t see why using websockets would require us to get rid of the MUST use TLS. 

The security of relays is a total disaster if you don’t have this so if the MUST be security authenticated goes away for relays, then I suspect this mechanisms is too broken to publish.

Cullen ( in my individual contributor role just to be clear )

On Jan 11, 2014, at 2:54 PM, Ben Campbell <ben@nostrum.com> wrote:

> 
> On Jan 10, 2014, at 5:34 PM, Ben Campbell <ben@nostrum.com> wrote:
> 
>> --3
>> 
>> I am not happy with the downgrade of of the TLS requirement between client and relay. I recognize that WebSocket
> 
> Robert pointed out to me that my comments on this section were truncated. Apparently I'm not qualified for this email gizmo. Here's another try:
> 
> I recognize that the WebSocket API limits the application's ability to control the security parameters of the connection. I think this is a general issue for moving application protocols to use WebSocket, that perhaps needs to be addressed in the WebSocket API.  We probably need an whole IETF (or at least RAI+APPS) policy for how to handle this. But MSRP is somewhat unusual in having a "MUST use" TLS requirement, and in the current security climate we need to take a really hard look at anything that weakens the normative security requirements of a messaging protocol.
> 
> I don't have an answer for how to proceed, but at a minimum I would like to see considerably more discussion of the implications and any potential mitigation of this in the Security Considerations sections.
> _______________________________________________
> RAI mailing list
> RAI@ietf.org
> https://www.ietf.org/mailman/listinfo/rai