Re: [hybi] Experiment comparing Upgrade and CONNECT handshakes

[Adam Barth <[e-mail]>]

On Fri, Nov 26, 2010 at 4:55 PM, Greg Wilkins <[e-mail]> wrote:
> on the whole, your paper looks like excellent work and I think you have
> discovered a existing vulnerability  which obviously needs to be fixed.

Thanks.

> With regards to websocket, your paper says:
>   " Our advertisement contains a SWF which performs the WebSocket handshake,
> spoofs an HTTP request upon handshake success,..."
>
> Was the spoofed HTTP request framed as a websocket frame?

Nope.  It's the handshake's job to establish that it's safe to let the
attacker to communicate on the socket.

> Would it be possible for you to repeat the experiment, but with the framing
> changes proposed to make WS frames less likely to be interpreted as HTTP (ie
> flipping the sense of the more bit). Also it would be interesting to see if
> the exchange of HELLO frames after the handshake had an effect on
> transparent proxies.

The exchange of HELLO frames adds an extra round-trip.  There's no
need to delay the connection with an extra round trip.

Adam