Re: [hybi] handshake security (was: Frame size)

[Jamie Lokier <[e-mail]>]

Ian Hickson wrote:
> On Mon, 19 Apr 2010, Thomson, Martin wrote:
> > >
> > > The idea is not to make the client able to do anything, the idea is to 
> > > make the server more likely to fail to get to the point where it is 
> > > accepting frames without having checked that it's a Web Socket client.
> > 
> > That's the tension.  The lazy server implementer does the minimum that 
> > they believe they can get away with.  If they have to interoperate with 
> > browsers, they will do the minimum to interoperate with browsers.
> > 
> > That leaves a lot of room for error - and you know what, that's probably 
> > OK.  The only one who suffers is the server implementer.  They are the 
> > ones being duped.
> 
> Also the user.
> 
> I think that both the implementor getting duped and the user getting duped 
> are problems that we should do our best to help with. I do not want to be 
> responsible for developing a protocol where half the deployments are 
> vulnerable to attack, even if those bugs are technically flaws in the 
> implementations and not in the protocol.

One little flaw in the plan:

Won't all lazy implementors just cut and paste the handshaking code
and then put their minimal server code after it?

-- Jamie