Re: [dispatch] [RAI] MSRP Expert Review of draft-pd-dispatch-msrp-websocket-04

We can put back the MUST if you want, but from a client point-of-view it
doesn't seem to make sense as choosing between TLS and not TLS is just a
matter of what WebSocket URI is used in the browser.  Further, unless you
have a trusted CA signed certificate on the server a browser won't allow
the connection - there is no UI to let you accept an exception like you
have with a web-page.

Even if TLS is left as MUST all of the additional checks from the RFC
cannot be enforced on the client because (in a browser) you don't have any
access to that information.

My reason for loosening the MUST to a SHOULD was that, pragmatically, the
security level in the MSRP Relay RFC is not achievable here.  Also, if you
are deploying MSRP internally (and did not require encryption) the
certificate handling in a browser (requiring the organisation to pay for a
certificate or importing something into each browser) is not something that
(realistically) people will do.

So by all means let's put MUST back if you want it there - but (should
anyone actually use this on a private network) that MUST will probably just
be ignored anyway.  Which makes me think SHOULD probably matches how things
will actually be used anyway.

Regards,

Peter

On 29 January 2014 11:42, Iñaki Baz Castillo <ibc@aliax.net> wrote:

> 2014-01-29 Cullen Jennings (fluffy) <fluffy@cisco.com>:
> > I don't see why using websockets would require us to get rid of the MUST
> use TLS.
> >
> > The security of relays is a total disaster if you don't have this so if
> the MUST be security authenticated goes away for relays, then I suspect
> this mechanisms is too broken to publish.
>
> Neither I understand why the "MUST use TLS" should be dropped for MSRP
> over WebSocket. I cannot figure out any reasons for getting rid of
> that requirement. If it was valid and appropriate for MSRP over TCP
> then it should also be for MSRP over WebSocket.
>
> Just my opinion.
>
>
> --
> Iñaki Baz Castillo
> <ibc@aliax.net>
> _______________________________________________
> dispatch mailing list
> dispatch@ietf.org
> https://www.ietf.org/mailman/listinfo/dispatch
>

-- 
Peter Dunkley
Technical Director
Crocodile RCS Ltd