[http-auth] Stephen Farrell's Yes on draft-ietf-httpauth-basicauth-update-06: (with COMMENT)

["Stephen Farrell" <[e-mail]>]

Stephen Farrell has entered the following ballot position for
draft-ietf-httpauth-basicauth-update-06: Yes

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/draft-ietf-httpauth-basicauth-update/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------


This is a pretty crappy auth scheme, but this is a pretty
good update and fills a need, thanks for the latter:-)

- section 2: is it worth saying somewhere that you can't
really have >1 proxy-auth happening even if you transit >1
proxy?

- section 2, last para: I assume this is because client
and/or server behaviour varies for this? If so, maybe it'd
be good to give some guidance or add a reference (if a
good one exists). If there's some other reason, it'd be
good to say too. 

- section 4: would it be worth adding some guidance that
re-use of e.g. entreprise login/SSO passwords for
proxy-auth is particularly dodgy as is not protected via
TLS?