Re: [http-auth] Working Group Last Call for draft-ietf-httpauth-basicauth-update-03.txt

[Michael Sweet <[e-mail]>]

My comments:

- Section 2 makes the "charset" parameter OPTIONAL. I'm wondering if this should be RECOMMENDED in order to encourage adoption of UTF-8 usernames and passwords since that solves common deployment and interop issues.

- Section 2.1 uses "can" (servers can use the "charset" authentication parameter...) If "charset" is OPTIONAL in section 2, I think this should be "MAY" (servers MAY use ...), and if RECOMMENDED this should be "SHOULD" (servers SHOULD use ...), although then you'd want to clarify that it is a SHOULD when using UTF-8...

- Section 4 doesn't talk about using TLS/HTTPS, which is a common method for providing some level of protection for the cleartext password in transit.  It might be sufficient to simply expand on "enhancements", e.g.:

   Because Basic authentication involves the cleartext transmission of
   passwords it SHOULD NOT be used (without enhancements such as HTTPS [RFC2818])
   to protect sensitive or valuable information.

  with a corresponding informative reference to RFC 2818 in section 7.2.  That at least provides a pointer without endorsing Basic + HTTPS as a "secure" combination...



> On Dec 2, 2014, at 6:19 AM, Yoav Nir <[e-mail]> wrote:
> 
> Thank you, Julian
> 
> This begins a 2-week WGLC for this document.
> 
> Please take the time to read through and post any comments to the list.
> 
> Cheers
> 
> Matt & Yoav
> 
>> On Dec 2, 2014, at 1:16 PM, [e-mail] wrote:
>> 
>> 
>> A New Internet-Draft is available from the on-line Internet-Drafts directories.
>> This draft is a work item of the Hypertext Transfer Protocol Authentication Working Group of the IETF.
>> 
>>       Title           : The 'Basic' HTTP Authentication Scheme
>>       Author          : Julian F. Reschke
>> 	Filename        : draft-ietf-httpauth-basicauth-update-03.txt
>> 	Pages           : 14
>> 	Date            : 2014-12-02
>> 
>> Abstract:
>>  This document defines the "Basic" Hypertext Transfer Protocol (HTTP)
>>  Authentication Scheme, which transmits credentials as userid/password
>>  pairs, obfuscated by the use of Base64 encoding.
>> 
>> 
>> The IETF datatracker status page for this draft is:
>> https://datatracker.ietf.org/doc/draft-ietf-httpauth-basicauth-update/
>> 
>> There's also a htmlized version available at:
>> http://tools.ietf.org/html/draft-ietf-httpauth-basicauth-update-03
>> 
>> A diff from the previous version is available at:
>> http://www.ietf.org/rfcdiff?url2=draft-ietf-httpauth-basicauth-update-03
>> 
>> 
>> Please note that it may take a couple of minutes from the time of submission
>> until the htmlized version and diff are available at tools.ietf.org.
>> 
>> Internet-Drafts are also available by anonymous FTP at:
>> ftp://ftp.ietf.org/internet-drafts/
>> 
>> _______________________________________________
>> http-auth mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/http-auth
> 
> _______________________________________________
> http-auth mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/http-auth

_________________________________________________________
Michael Sweet, Senior Printing System Engineer, PWG Chair