Re: [hybi] workability (or otherwise) of HTTP upgrade

[Zhong Yu <[e-mail]>]

On Thu, Dec 9, 2010 at 3:51 AM, SM <[e-mail]> wrote:
> Hi Zhong Yu,
> At 22:54 08-12-10, Zhong Yu wrote:
>>
>> WS clients should relax the rules of certificate validation. Don't
>> panic on self-signed certificates like current browsers do which
>> doesn't make any sense. If WSS with self-signed certificates are not
>> treated more badly than plain WS,  frugal application developers don't
>> need to spend any money to use WSS for the purpose of improving
>> success rate. WS server can even automate self-signed certificate so
>> that developers don't need to spend much time either.
>
> See http://tools.ietf.org/html/draft-saintandre-tls-server-id-check-11

Thanks. In section 1.1 Motivation
"In general, a client needs to verify that the server's presented
identity matches its reference identity so it can be sure that the
certificate can legitimately be used to authenticate the connection."

That doesn't necessarily apply here. We don't require that WS
connections are authenticated. Client can already talk to sever in
plain text on unsecured connection. There is no error, no warning. Now
if the connection is encrypted with self-signed certificate, security
is not weakened, so why should client panic and raise the most scary
alarm to user?

One may argue that the semantics of HTTPS requires that server id be
verified. When client makes an HTTPS connection and cannot verify
server id, it is *required* to panic. That makes sense.

We can also imagine an HTTPE protocol, where only encryption is
required, server id verification is optional. This protocol would also
be tremendously useful. It's a shame it doesn't exist, and low budget
web apps are forced to do without encryption.

Since we are designing a new protocol, it's not set in stone yet that
WSS must verify server id. I recommend that WS API allows developers
to turn it off.

  var socket = new WebSocket('wss://example.com');
  socket.allowSelfSignedCertificate();

This is not an API issue only. When we discuss connectivity issues of
WS connections, it's important to know the cost of using TLS to
developers.

When WS client displays connection security property to user, it
certainly shouldn't display such connections as secure as
authenticated connection. On the other hand, it certainly shouldn't
display it as less trustworthy than plaintext connection either.

- Zhong


> I suggest using the certid mailing list (
> https://www.ietf.org/mailman/listinfo/certid ) for any follow up.
>
> Regards,
> -sm
>