Re: [hybi] WebSocket handshake (HTTP and SSO)

In my mind, what would really help is a specific enumeration of attacks with
some minimal amount of information as reference, rather than only saying
"protect against cross protocol attacks." There are some experts in the
group who have much of this in their head, for the rest of us, it's really
nice to have a list that we can evaluate alternate proposals against, and
verify that "Yes, proposal X protects against attacks 1-5, while Proposal Y
misses attack 4."

Otherwise, it's really hard to have concrete discussions IMO.

On Wed, Sep 1, 2010 at 5:18 PM, Gabriel Montenegro <gmonte@microsoft.com>wrote:

> I would hope that a potential simplification of this is still possible,
> specially if it does not water down whatever guarantees it is supposed to
> provide. I was assuming we would revisit this in the next phase after the
> framing got solidified.
>
> > -----Original Message-----
> > From: hybi-bounces@ietf.org [mailto:hybi-bounces@ietf.org] On Behalf Of
> Greg
> > Wilkins
> > Sent: Wednesday, September 01, 2010 5:04 PM
> > To: Joe Hildebrand
> > Cc: hybi; Brodie Thiesfield
> > Subject: Re: [hybi] WebSocket handshake (HTTP and SSO)
> >
> > On 2 September 2010 09:41, Joe Hildebrand <joe.hildebrand@webex.com>
> > wrote:
> > > On 9/1/10 5:30 PM, "Greg Wilkins" <gregw@webtide.com> wrote:
> > >
> > >> Sec-WebSocket-Key1: the ietf process failed 12345678
> > >
> > > It's too early to declare that, I hope.
> > >
> > > Let's start by understanding the requirement.  Gabriel, it looks like
> we
> > > don't have anything that addresses the rationale behind this
> handshaking
> > > approach in the requirements draft -- do you concur?
> >
> > Joe,
> >
> > as Adam pointed out, I think we do have consensus on the general
> > requirement - ie that we should protect against cross protocol
> > attacks.
> > While I don't think everybody agreed about the possibility of an
> > injection attack, I think there were very few who did not accept that
> > a nonce was a good idea.
> >
> > It is just that when the nonce was added to the draft, it came with a
> > unilaterally invented non discussed encoding of random characters and
> > spaces.  It was also used as part of a fast fail attempt that has
> > further confused the issue.
> > I agree with John that this is not a huge technical issue, but I think
> > the strangeness of the encoding causes confusion, clouds the real
> > issue and is a potential ongoing cause of misunderstandings.
> >
> > Anyway, I've used up my message quota on this issue, so I'll let it
> > go.  I think the process failed letting this get into an ietf WG draft
> > in the first place, but it wont be the end of the world if it stays
> > in.
> >
> > cheers
> > _______________________________________________
> > hybi mailing list
> > hybi@ietf.org
> > https://www.ietf.org/mailman/listinfo/hybi
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi
>