Re: [http-state] Security considerations overview

[=JeffH <[e-mail]>]

<individual>

I agree with David Morris wrt that particular paragraph being obtuse, 
especially to those who are not deeply schooled in the intricacies of web 
(in)security.

I think this can be addressed by a combination of (a) further wordsmithing, (b) 
forward reference to the more detailed exposition to follow (which I'm not sure 
folks in the thread have reviewed), and (c) appropriate citations. This para is 
simply part of an overview.


(a) (b) here's a build on Adam's latest suggestion, wrt that paragraph, which 
tries to address David's concerns..

   Transport-layer encryption, such as that employed in HTTPS, is
   insufficient to prevent a network attacker from obtaining or altering a
   victim's cookies because the cookie protocol itself has various
   vulnerabilities (see "Weak Integrity", below). In addition, by default,
   the cookie protocol does not provide confidentiality from network attackers,
   even when used in conjunction with HTTPS.


(c) e.g. informative references such as..

   ForceHTTPS: Protecting High-Security Web Sites from Network Attacks
   https://crypto.stanford.edu/forcehttps/

..which describes many of the issues with the present "cookie protocol".


It seems to me that addressing the details that are being discussed in this 
thread is more properly done in the presently-entitled section "Weak Integrity" 
  of the SecCons section in -05pre...

http://github.com/abarth/http-state/blob/master/drafts/cookie.xml


=JeffH


</individual>