Re: [hybi] [Technical Errata Reported] RFC6455 (3215)

[Jesse Katzman <[e-mail]>]

Hi John,

Thank you for the explanation.  I didn't realize it meant an in-browser
application.  I understand now.

Thanks again,
Jesse
On May 6, 2012 11:01 PM, "John Tamplin" <[e-mail]> wrote:

> On Sun, May 6, 2012 at 8:30 PM, RFC Errata System <
> [e-mail]> wrote:
>
>> Type: Technical
>> Reported by: Jesse Katzman <[e-mail]>
>>
>> Section: 5.3
>>
>> Original Text
>> -------------
>> The unpredictability of the masking key is essential to prevent authors
>> of malicious applications from selecting the bytes that appear on the wire.
>>
>> Corrected Text
>> --------------
>>
>>
>> Notes
>> -----
>> I don't see how the client-to-server masking prevents "authors of
>> malicious applications from selecting the bytes that appear on the wire".
>>
>> Maliciously changing the contents of a message simply requires a few more
>> steps than it would without masking, as far as I can tell.
>>
>
> Masking the client->server frames was heavily debated on this list for
> months -- I encourage you read the archives rather than rehashing the
> debate.
>
> Basically, WebSockets is unique in that you need to protect the network
> infrastructure, even if you have hostile code running in the client, full
> hostile control of the server, and the only piece you can trust is the
> client browser.  By having the browser generate a random mask for each
> frame, the hostile client code cannot choose the byte patterns that appear
> on the wire and use that to attack vulnerable network infrastructure.
>
> --
> John A. Tamplin
> Software Engineer (GWT), Google
>