Re: [hybi] Handshake was: The WebSocket protocol issues.

[Adam Barth <[e-mail]>]

On Sat, Oct 2, 2010 at 4:09 AM, Greg Wilkins <[e-mail]> wrote:
> The fact that DNS is almost vulnerable to HTTP is interesting, but not
> really relevant to the proposals we have to refine the WS handshake.
> Are you really saying that because DNS is almost vulnerable to crafted
> HTTP requests, that we must space inject the nonces in websocket
> handshakes or leave our hashes unframed?

I'm saying these issue are subtle and require careful thought.  The
success or failure of HTTP POST to attack DNS depends critically on a
number of seemingly irrelevant details about how browsers generate and
process network messages.

I brought up the example of DNS to show how an attacker might be able
to get a non-WebSocket server to rely the c-nonce to the attacker and
let the attacker relay back with the HMAC of the c-nonce.  This
example might not completely break the c-nonce handshake, but it's
evidence that relying upon an HMAC alone is probably unwise.

Adam