Re: [hybi] Handshake was: The WebSocket protocol issues.

[Greg Wilkins <[e-mail]>]

On 26 September 2010 18:35, Adam Barth <[e-mail]> wrote:
>> But I think that the usage of Sec- headers and a simple nonce
>> will give very good protection and that we only need do more if there
>> is a real clearly identified risk.
>
> With all due respect, I'm not convinced you have a strong enough
> handle on the required security properties to make such a bold claim.

Adam,

with all due respect we need a more mature approach than - "tharr be
monster tharrrr!"

If you are unable to clearly define the problems that the current
handshake is trying to solve, then please find somebody with standing
to contradict my statement.

I have yet to see any description of any threat that is not addressed
by the Sec-headers and a nonce, nor do I see these as a whack a mole
approach.
Together these represent a type of header that a HTTP javascript
client is unable to generate and knowledge that a javascript code is
unable to know.

What additional specific or generic attack vector is the space
insertion, character stripping and unframed binary data protecting
from.

regards