Re: [hybi] Handshake was: The WebSocket protocol issues.

[Maciej Stachowiak <[e-mail]>]

Here is an email from February where I summarized some of the risks from cross-protocol attacks for WebSocket:

http://www.ietf.org/mail-archive/web/hybi/current/msg01198.html

Sorry about the formatting, it seems that the archives didn't like my mail client. You may have an easier time reading it if you copy that web page into an editor that wraps lines.

Important thing to keep in mind: there are potential attacks in either direction. We must make sure that WebSocket protocol cannot be used for cross-protocol attacks on existing HTTP servers, and we want to make sure that WebSocket servers are not vulnerable to cross-protocol attacks from HTTP.

Cross-protocol attacks are a subtle and complicated issue. If you search for the phrase "cross-protocol attacks" on your favorite search engine you can find more issues about this general area.

Regards,
Maciej 

On Sep 24, 2010, at 2:52 AM, Alexander Voronin wrote:

> What kind of cross-protocol attacks You are talking about all this time? Using simplest handshake with framed data transfer and relied on browser security policies it seems to be impossible. Do You have any real examples on this?
> 
> 2010/9/24 Maciej Stachowiak <[e-mail]>
> 
> 
> This proposal does not appear to defend against a cross-protocol attack on a WebSocket server using a browser-hosted HTTP API.
> 
> It also appears to add more round trips before actual message sending can begin in either direction.
> 
> Regards,
> Maciej
> 
> 
> 
> 
> 
> -- 
> когда я опустился на самое дно, снизу мне постучали..