Re: [http-auth] Working Group Last Call for draft-ietf-httpauth-basicauth-update-03.txt

[Julian Reschke <[e-mail]>]

On 2014-12-05 18:21, Benjamin Kaduk wrote:
> On Tue, 2 Dec 2014, Yoav Nir wrote:
>
>> Thank you, Julian
>>
>> This begins a 2-week WGLC for this document.
>>
>> Please take the time to read through and post any comments to the list.
>
> My apologies if this has already been covered, but the abstract includes
> the phrase "obfuscated by the use of Base64 encoding" (the introduction
> includes similar content).  It looks like this was introduced in the -01,
> and the on-list discussion of the -00 didn't really talk about it -- there
> was a note from Bjoern that the abstract "could use another sentence
> stating what the `Basic` scheme is", but the word "obfuscate" did not
> appear.  As such, I thought I would mention it now -- it's not really
> clear that Base64 encoding counts as obfuscation in this context, where
> the HTTP headers make it very clear that the userid/password are being
> conveyed.

I think that "obfuscate" pretty much nails it.

> I think the submission checklist wants the abstract (and introduction?) to
> explicitly mention when an RFC is being updated or obsoleted.  Relatedly,

I've heart that before, but I also heard the opposite at some other 
point. I'll wait for the IESG feedback on this.

> the first clause of the introduction says that this document defines
> "basic", but the citation to RFC 7235 could be read as if it is a citation
> for "basic" (as opposed to HTTP Authentication); perhaps this is better:
>
> % This document defines "Basic" as a Hypertext Transfer Protocol (HTTP)
> % Authentication Scheme ([RFC7235]), which transmits credentials as
> % Base64-encoded userid/password pairs.

Concern understood, but now the "which" applies to the wrong term.

I'll try to address this differently.

> Section 3 says that "Senders can use the new 'charset' parameter", but it
> seems that only servers can do so.  Was this intended to say "Servers"
> instead of "Senders"?

I believe my intent was to include proxies, but then, "server" includes 
proxies too.

> Section for says that the transmission of the password is "essentially
> cleartext", whereas section 1 just says that it is "cleartext".  Which is
> it?

I'll remove the "essentially" from the Security Considerations.

> Grammar nits:
>
>
> In section 2:
>
> % 1.  obtains userid and password from the user,
>
> I would add the definite article "the" before "userid" to match the other
> items.

ack.

> In the paragraph following that list, I would s/compatible to/compatible
> with/.

ack.

> In the paragraph following that paragraph, you could add "The" at the
> beginning to avoid starting the sentence with the identifier "userid" (and
> the ensuing debate about whether to capitalize the initial letter).

Thanks a lot for the feedback!

-> <http://trac.tools.ietf.org/wg/httpauth/trac/changeset/89>

Best regards, Julian