Re: [http-state] Whether to recommend the cookie protocol (was Re: I-D Action:draft-ietf-httpstate-cookie-04.txt)

[David Morris <[e-mail]>]

On Wed, 24 Feb 2010, Adam Barth wrote:

> On Wed, Feb 24, 2010 at 1:19 PM, David Morris <[e-mail]> wrote:
> > On Wed, 24 Feb 2010, Adam Barth wrote:
> >>
> >> [[
> >>       The cookie protocol has many
> >>       historical infelicities that degrade its security and privacy.
> >> ]]
> >
> > Better, but I think 'infelicities' is not a common word and its use would
> > make the docuemnt harder to read.
> 
> That sounds like an editorial decision.  On a previous thread someone
> mentioned that they happened to like this word.  :)

I don't dislike the word, after I looked it up, I recognize it fits 
Consider this editorial advice ... don't use words that aren't commonly 
known to your english speaking audience. The remainder of the 
international audience won't have a clue and will either have to look the 
word up or choose to not accurately understand what you have written.

> 
> >> How do folks feel about this related statement in Security Considerations:
> >>
> >> [[
> >>         <t>For applications that use the cookie protocol, servers SHOULD
> >>         NOT rely upon cookies for security.</t>
> >> ]]
> >
> > Given that we are documenting an existing protocol, a SHOULD NOT statement
> > is probabaly excessive.
> >
> > I think we should instead stress (and document those that are known) that
> > there are many opportunities to compromise the content of cookies
> > including insertion of rogue cookies and/or removing valid cookies. Hence,
> > the design of applications which depend on cookies should carefully
> > consider the impact on application data integrity (and security) if
> > the cookie mechanism is subverted. In this context, I use application
> > in the classic sense of a set of computer software which delivers some
> > form of service to people or other computer applications.
> 
> We now have a fairly detailed Security Considerations section that
> discusses all the security issues I know of with the cookie protocol.
> If you know of things that aren't covered, please let me know and I'll
> add them.
> 
> I'm somewhat on the fence as to whether the general advice is helpful.

My basic point, which reiterates what others have experessed, is that we 
can't forbid usage for which you don't have a better proposed alternative.

Appropriate general advice ... "Read and understand the Security 
Considerations" section and take the steps appropriate and necessary
to reduce the risk to an acceptable level." Or something like that.