Re: [hybi] Handshake was: The WebSocket protocol issues.

[Maciej Stachowiak <[e-mail]>]

On Oct 9, 2010, at 2:46 PM, Greg Wilkins wrote:

> 
> With regards to my null trial - I agree that such "surveys" (specially
> with a sample size of 1) are not really indicative, only somewhat
> informative.      However, I do think we need to analyse our framing
> from the perspective of could WS frames be mistaken for HTTP requests.

If we encrypt the connection, as in Adam and Eric's proposal, or as suggested earlier by me, then such an analysis is not required. From the attacker's perspective, every frame they send would look like random bytes. It would not be possible to control the bytes to look like an HTTP message. Conversely it would also be impossible to make a chosen HTTP message body look like WebSocket frames.

If the attacker is unable to send specific chosen bytes as a message frame, that is a much stronger defense against cross-protocol attacks than relying on a coincidence of valid message frames not looking like an HTTP request. Or at least, it is easier to have a high degree of confidence in the analysis.

I note in passing that this defense is somewhat independent of whether to use a CONNECT-based or Upgrade-based handshake.

Regards,
Maciej