Re: [hybi] workability (or otherwise) of HTTP upgrade

[Maciej Stachowiak <[e-mail]>]

On Dec 8, 2010, at 8:10 PM, Jack Moffitt wrote:

> One path is to combine the separate port idea along with the
> encryption based approach. On the WebSocket port, you could avoid all
> the intermediary issues, but perhaps be limited by firewalls.
> However, you would not need any obfuscation and could easily use
> sendfile().  On the TLS port you use NPN to get a WebSocket that is
> not going to cause security problems with intermediaries.
> 
> For the short term, we get WebSocket on the port with the highest
> success rate, and in the long term, we have firewalls accepting the
> new port as killer applications make people care.
> 
> If we're going to lose the sendfile(), why not go the rest of the way?
> Or is there something I'm missing in the port 80 but just XORed case?

If the attacker can choose an arbitrary port to connect to, then you still need some form of obfuscation or attempt to avoid looking like valid HTTP, since they could chose port 80, 8080, 8000, or other ports not infrequently used for HTTP.

Regards,
Maciej