Re: [http-auth] Barry Leiba's Discuss on draft-ietf-httpauth-hoba-09: (with DISCUSS and COMMENT)

[Barry Leiba <[e-mail]>]

> A proto -10 version with changes indicated below is at [1] the
> diff vs. -09 at [2].

Will try to look at that later (Tues evening, China time).

>> This document would benefit from some section somewhere giving a
>> set of clear, numbered steps, saying who sends, who receives, and
>> who does what with what input at each step.  I will propose such
>> text.
>
> And I'll happily look at that when it's available. (And hope to
> not have to wait much:-)

That's also on the schedule for after dinner.

>> The abstract appears to overstate the password issue.  It'd be
>> better for the abstract to say that it eliminates the transmission
>> of passwords and their storage on the server, which are really the
>> points.
>
> TBH, I prefer the current text a lot.

OK; thanks for having a look (and also for some of the other items).

> I'd be against adding such. IMO an implementation like that is not a
> great idea as it's phishable (the user won't know that the password is
> local only and will re-use the same password in more than one place).

A good point, which I hadn't considered; thanks.

>> -- Section 8 --
>>
>> The first paragraph doesn't say enough to make sense to me.
>> Perhaps a few more words about why?
>
> I swapped the 1st and 2nd paras. The 1st was a bit abrupt yes
> but I think it fits better now.

Will look tonight, but I bet you're right.

> I think we covered this sufficiently. I do not want to
> get into recommending ways HOBA implementers can do what
> really ought be an OS/platform function. In the end I
> added that specific point and did tweak a bit though.

T'anks.

>> -- Sections 9.4 and 9.5 --
>>
>> Might there be any advice for the designated expert, anything at
>> all?
>
> No, I think it's fine - there is no equivalent to the
> sig alg thing in 9.3 needed.

OK.

b