Re: [hybi] WebSocket, TLS and intermediaries

Willy Tarreau <w@1wt.eu> Wed, 21 July 2010 04:48 UTC

Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 028513A6B59 for <hybi@core3.amsl.com>; Tue, 20 Jul 2010 21:48:06 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.14
X-Spam-Level:
X-Spam-Status: No, score=-4.14 tagged_above=-999 required=5 tests=[AWL=-2.097, BAYES_00=-2.599, HELO_IS_SMALL6=0.556]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AM1wzEAWdwru for <hybi@core3.amsl.com>; Tue, 20 Jul 2010 21:48:05 -0700 (PDT)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id 8C5C63A6B4F for <hybi@ietf.org>; Tue, 20 Jul 2010 21:48:04 -0700 (PDT)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id o6L4mGG5029486; Wed, 21 Jul 2010 06:48:16 +0200
Date: Wed, 21 Jul 2010 06:48:16 +0200
From: Willy Tarreau <w@1wt.eu>
To: Maciej Stachowiak <mjs@apple.com>
Message-ID: <20100721044816.GC26999@1wt.eu>
References: <h2w5c902b9e1004152345j992b815bz5f8d38f06a19181a@mail.gmail.com> <Pine.LNX.4.64.1004160701250.751@ps20323.dreamhostps.com> <4BC860FD.8080007@webtide.com> <Pine.LNX.4.64.1004161952530.751@ps20323.dreamhostps.com> <35EFEA5E-9017-48A1-BB66-A0AF947E159F@d2dx.com> <AANLkTinihlL2sn3Kiwtcl7QYKhFlvmj9lvmH4_z02xF7@mail.gmail.com> <FC1F510E-6D48-4D75-A356-F455C9FD5BD8@apple.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <FC1F510E-6D48-4D75-A356-F455C9FD5BD8@apple.com>
User-Agent: Mutt/1.4.2.3i
Cc: Hybi <hybi@ietf.org>
Subject: Re: [hybi] WebSocket, TLS and intermediaries
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 21 Jul 2010 04:48:06 -0000

On Tue, Jul 20, 2010 at 05:01:02PM -0700, Maciej Stachowiak wrote:
> > BTW - there is another data point here; deployment of WebSockets over port 80 was measured in Chrome to have ~67% success rate today.  Deployment over port 443 (with TLS) has a >95% success rate.  So, if you don't use TLS, then browsers and websites will need to be made more complex to deal with the edge case of WebSockets failing in weird ways due to existing intermediaries which fail, even after the WebSocket handshake.
> 
> This point is very important. Building on top of TLS has huge practical benefits. I think this outweighs the desire to more easily build transparent intermediaries. Any mechanism that allows intermediaries without being authorized by either endpoint is by definition a security vulnerability in the protocol.
> 
> I think the benefits of TLS also outweigh the "amateur server implementor" argument. I don't think we want to make it easy to implement a security hole.

There's no "security hole" here. If you don't need security, use port 80,
if you need security, use port 443. That's been working that way for the
web for decades and that's no secret even for non-technical people. Clear
traffic offers reliability and large possibilities while ciphered traffic
offers security with less possibilities. Nothing new here.

Willy