Re: [Jmap] JMAP security

[Alexey Melnikov <[e-mail]>]

Hi Дмитрий,


On 09/02/2017 16:33, Дмитрий Подкорытов wrote:
> Hello, Yoav.
>
>     Четверг, 9 февраля 2017, 0:01 +05:00 от Yoav Nir
>     <[e-mail]>:
>
>
>     On 8 Feb 2017, at 19:28, podkorytov <[e-mail]
>     <mailto:[e-mail]>> wrote:
>

>>     Any browser plugins such as Adobe's or something else may be
>>     potencial hole and targets for attacks.
>>
>     Since we do expect browser use, that is definitely something to
>     consider.  Preventing plug-ins and scripts running in other tabs
>     from sending requests on behalf of the user should certainly be a
>     goal for the protocol.  There are some ways of doing that:
>     authenticating each HTTP request with something better than
>     session cookies, making the resource names unpredictable, etc.
>     That is definitely part of the design.
>>
>>     Probably it question out of frames of protocol draft , but it
>>     practical thing ang may to influence on JMAP success or fail. It
>>     will works inside browser with many others web applications and
>>     plug-ins
>>
>     Security considerations are part of every IETF document and
>     discussion of security vulnerabilities within the operating
>     environment are very much in scope.
>
>
> Stateless protocols sometimes may be on MITM attack, somebody is able 
> to catch TCP packet from JMAP client and repeat it many times.
> All needed for authorization already inside this single packet, right ?
> Destination in this case will be under DoS attack. What is planning in 
> JMAP for preventing such things ?
> Maybe random field in JSON structure or time stamp with high precision?
JMAP should be running over HTTPS, which should make it much more difficult.

Best Regards,
Alexey