Re: [http-auth] Working Group Last Call for draft-ietf-httpauth-basicauth-update-03.txt

[Benjamin Kaduk <[e-mail]>]

On Fri, 5 Dec 2014, Julian Reschke wrote:

> > My apologies if this has already been covered, but the abstract includes
> > the phrase "obfuscated by the use of Base64 encoding" (the introduction
> > includes similar content).  It looks like this was introduced in the -01,
> > and the on-list discussion of the -00 didn't really talk about it -- there
> > was a note from Bjoern that the abstract "could use another sentence
> > stating what the `Basic` scheme is", but the word "obfuscate" did not
> > appear.  As such, I thought I would mention it now -- it's not really
> > clear that Base64 encoding counts as obfuscation in this context, where
> > the HTTP headers make it very clear that the userid/password are being
> > conveyed.
>
> I think that "obfuscate" pretty much nails it.

I would hope you think so, given that you wrote it :)

I do not have strong feelings, myself, but it does seem like something
that should at least be discussed on the list, since there is some reason
to believe that people with strong opinions do exist.

> > I think the submission checklist wants the abstract (and introduction?) to
> > explicitly mention when an RFC is being updated or obsoleted.  Relatedly,
>
> I've heart that before, but I also heard the opposite at some other point.
> I'll wait for the IESG feedback on this.

Sure, no particular hurry.

> > the first clause of the introduction says that this document defines
> > "basic", but the citation to RFC 7235 could be read as if it is a citation
> > for "basic" (as opposed to HTTP Authentication); perhaps this is better:
> >
> > % This document defines "Basic" as a Hypertext Transfer Protocol (HTTP)
> > % Authentication Scheme ([RFC7235]), which transmits credentials as
> > % Base64-encoded userid/password pairs.
>
> Concern understood, but now the "which" applies to the wrong term.
>
> I'll try to address this differently.

Thanks -- I was not super-happy with my new text, either.

-Ben