Re: [hybi] Handshake was: The WebSocket protocol issues.

[Ian Fette (イアンフェッティ) <[e-mail]>]

I would really like to be able to just use NPN and call it a day. FWIW.

On Sat, Oct 9, 2010 at 8:41 PM, Maciej Stachowiak <[e-mail]> wrote:

>
> On Oct 9, 2010, at 2:46 PM, Greg Wilkins wrote:
>
> >
> > With regards to my null trial - I agree that such "surveys" (specially
> > with a sample size of 1) are not really indicative, only somewhat
> > informative.      However, I do think we need to analyse our framing
> > from the perspective of could WS frames be mistaken for HTTP requests.
>
> If we encrypt the connection, as in Adam and Eric's proposal, or as
> suggested earlier by me, then such an analysis is not required. From the
> attacker's perspective, every frame they send would look like random bytes.
> It would not be possible to control the bytes to look like an HTTP message.
> Conversely it would also be impossible to make a chosen HTTP message body
> look like WebSocket frames.
>
> If the attacker is unable to send specific chosen bytes as a message frame,
> that is a much stronger defense against cross-protocol attacks than relying
> on a coincidence of valid message frames not looking like an HTTP request.
> Or at least, it is easier to have a high degree of confidence in the
> analysis.
>
> I note in passing that this defense is somewhat independent of whether to
> use a CONNECT-based or Upgrade-based handshake.
>
> Regards,
> Maciej
>
> _______________________________________________
> hybi mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/hybi
>