Re: [hybi] Handshake was: The WebSocket protocol issues.

[Scott Ferguson <[e-mail]>]

James Graham wrote:
> On 10/11/2010 02:28 PM, Greg Wilkins wrote:
>>
>
> So there is an underlying issue here that I don't understand. It seems 
> clear to me that Adam and Eric's proposed handshake has a better 
> security story with regard to cross-protocol attacks than -75, -76, or 
> any other proposal other than using NPN with TLS. However there seem 
> to be a number of people who have problems with this proposed 
> handshake to the extent that they are prepared to forgo the security 
> properties in order to get something different. In general people seem 
> to be aware that they are making the security weaker since the 
> arguments are mostly about how different approaches will probably be 
> good enough in practice even though they are theoretically inferior.
>
> What I haven't followed is what the problems with the proposal 
> actually are. I understand that I have likely missed these in other 
> messages, but it would be helpful if people who believe that the 
> proposed approach, or aspects of it, are unworkable could summarise 
> the outstanding issues they see.

Some of the problems with the proposal:

1. auditing - the proposal takes away the capability to audit requests 
after an attack. Remember, cross-protocol is not the only kind of 
attack. Server admins will want to track down access logs to find the 
problem, but the proposal makes these request log opaque to the server 
admins.

2. authorization - since the proposal no longer uses URL/method and 
specifically doesn't use a unique WEBSOCKET method, existing security 
systems in existing servers cannot be used. (<Limit>, .htaccess, etc.)

3. incompatibility with existing host/application dispatch models. In 
existing servers, the URL/host are used to dispatch to the server before 
processing. This proposal upends that model, requiring WebSocket to be 
dispatched before knowing the target resource.

4. performance - the proposal requires encryption of the entire data 
stream. That's not cheap on the server side.

To justify these security, performance, and management penalties, the 
proposal proposes an attack which requires the target machine to run an 
attacker program, assumes the target web server is under the control of 
the attacker, and assumes the target application has an additional open 
security hole to non-browser clients.

-- Scott
> _______________________________________________
> hybi mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/hybi
>
>
>