Re: [http-auth] side meeting on Wednesday, March 30

[Peter Saint-Andre <[e-mail]>]

When you finish creating your slides, could you send them to the list?

On 3/28/11 7:37 PM, Yutaka OIWA wrote:
> Dear all,
> 
> I'm looking forward to seeing you at 20:00 Wednesday in Karlin II/III.
> 
> My current plan for the side meeting is to mutually know each other's face by
> meeting face-to-face, and to share the problem space which is broken now and
> which is to be fixed by our future working group (hopefully).
> The important point here is that the solutions must be not only implementable to
> the HTTP client/server, but also deployable and usable by Web applications. I
> believe this is the most problematic point of current largely-unused solutions
> including TLS client certificate authentication.
> 
> I will prepare a small presentation which will describe *my* view of what should
> be done.  Your opinions and views are very welcome.
> Also, I am waiting of inputs for the possible future agenda quoted below.
> 
> See you,
> 
> Yutaka
> 
> -------- Original Message --------
> Subject: Re: [http-auth] HTTP Auth Next BOF at IETF Prague deadline
> Monday/Possible W3C Workshop?
> Date: Mon, 31 Jan 2011 20:54:37 +0900
> From: Yutaka OIWA <[e-mail]>
> To: Harry Halpin <[e-mail]>
> CC: [e-mail]
> 
> Dear Harry and all,
> 
> "Harry Halpin" <[e-mail]> writes:
> 
>> Another idea would be to hold an informal bar-BOF at Prague if the BOF
>> can't be put together quickly enough as a bar-BOF would require less work
>> and give us more time to bake the tech ideas or charter. I'll leave this
>> decision in the hands of more experienced IETF folks.
> 
> In both ways, anyway, we will need a good-direction proposal and
> agenda.  It is hard for me to write a "good" one, but I made a "bad" :-)
> one as a starting point.
> 
> Please consider it for improvements and rephrasing.  Thanks Harry for
> providing a very good descriptions which I've used as a staring point.
> 
>  * Things to consider:
> 
>    - agenda not yet written
>    - goal: currently ambiguous (intentionally); to discuss, or to form WG?
> 
> --------
> Description:
> 
> The current authentication methods used in the Web system is prone to
> various serious vulnerabilities, including password eavesdropping,
> password stealing, session hijack, and phishing.  Because of the lack
> of a good/secure support for web application authentication in the
> HTTP layer, people tends to use HTML forms for authentication, which
> are by nature insecure.
> 
> This problem should be solved as soon as possible to mitigate the
> impact of Web authentication-related frauds to the Internet
> users. However, to solve this problem, the resulting technologies
> should be carefully designed so that these will be well deployable to
> the real-world applications.
> 
> Recently we have several new proposals for securing Web/HTTP
> authentications, some of which has a proposed drafts.  In addition,
> the work of the HTTPBIS working group is about to finish, and it will
> require some maintenance works for the HTTP existing authentication
> mechanism, at least the registrations to IANA.
> 
> The purpose of the proposed BoF is to pursue creation of IETF working
> groups on various HTTP authentication issues.  The possible topics of
> the future working group may include the following topics:
> 
>  * Introduction of much more secure authentication mechanisms as
>    extensions to the HTTP.
> 
>  * Introduction of technologies which will enable more sophisticated
>    use of HTTP authentication in application layer.
> 
>  * Research on the secure ways of Web/HTML authentications and
>    required protocol-side support for them
> 
>  * Maintenance of existing HTTP authentication extensions (other than
>    Basic and Digest), either checking its httpbis-conforming or making
>    it historic.
> 
>  * Proposing addition of authentication schemes to the IANA registry
>    as proposed by httpbis.
> 
> Both BoF and possible future working group expect well coordination with
> W3C's effort on the related topics.
> 
> 
> BoF proposed agenda:
> 
>  * Topics to be discussed in the future working group
> 
>  * TBD
> 
> Logistical informations:
> 
> BoF Chairs: TBD
> BOF Proponents: Harry Halpin, Yutaka OIWA, ... (TBD)
> People expected: 50
> Length of session: 90min
> Conflicts to avoid: Working Groups in the APP and SEC areas
> WebEX: no
> Responsible AD: Peter Saint-Andre, Alexey Melnikov (tentative)
> Goal: to pursue creation of IETF working groups
> Drafts:  http://tools.ietf.org/html/draft-oiwa-http-mutualauth-08; more to be
> discussed
> Mailing List: HTTP http-auth mailing list
> Mailing List Archive: http://www.ietf.org/mail-archive/web/http-auth/
> --------
>