Re: [hybi] Handshake was: The WebSocket protocol issues.

[Greg Wilkins <[e-mail]>]

Adam,

thanks for sharing the details of the experiments that you almost made
work in your private lab.  Strangely enough we didn't know about these
unpublished efforts of yours, nor gave you any "authority" for them,
because you've didn't tell us about them.

But in the end, your experiment indicated that DNS servers cannot
generally be attacked by HTTP requests, so WS handshakes are also
currently OK, with or without framed nonces and no space encoded
headers.  WS also has extra defences, in that it cannot send an entity
body with the handshake, so that any target server that uses
characters from GET or POST as a binary length (as DNS apparently
does), will see a very long packet and the WS client has no way to put
data there unless the WS handshake is successful.

So this experiment is not an argument against the current proposal.
But I think it is very valuable to step through such potential attacks
(hence I keep asking for details), so we can analyse our defences and
perhaps consider others.

I've never argued against defence in depth, I simply do not believe
that unframe nonces and space injected keys are any significant
defences and that there are better alternatives.

So from your experiment, I would propose that we explicitly restrict
the ports that WS clients can contact other than 80/443 that are below
1024.  I see no reason at all to allow WS connection attempts to port
53.