[saag] WebSec summary IETF 83

[Alexey Melnikov <[e-mail]>]

Co-chairs: Tobias Gondrom and Alexey Melnikov

The WG met in the 1st afternoon session on Monday (26-March-2012). 
WebSec had a two hour session. The following topics were discussed:

HSTS (HTTP Strict Transport Security, 
draft-ietf-websec-strict-transport-sec-06.txt) is in WGLC. Major 
outstanding issues discussed at the meeting:

1). Some ABNF consistency issue

2). Discussed implications/handling of includeSubDomains directive. Some 
edge cases might not be covered in the document/not explicitly mentioned 
in the draft. For example handling of 0-lifetime HSTS pins in subdomains.

3). Discussed at length whether "no user recourse" should be allowed on 
any TLS error, or should exceptions be made for TLS certificate 
expiration. It looks like there doesn't seem to be consensus to change 
the current text (which doesn't make any exceptions for expired 
certificates).

Some support for having a new "this site is testing HSTS" directive.

Some agreement that informing users (and administrators) of why the site 
hard-failed is important, instead of just showing "you can't connect to 
this HSTS site, I will not tell whether CRL verification failed, or your 
cert is malformed, or the chain can't be verified".

4). Discussion on whether access to OCSP/CRL content should be exempted 
from HSTS policy covered by the includeSubDomains directive (they are 
frequently retrieved over HTTP). There are ways of addressing this in 
other ways (e.g. move the OCSP/CRL service to a different domain not 
covered by HSTS). No consensus to change the current text.

Yoav Nir presented the "Extended Origin" idea 
<http://www.ietf.org/proceedings/83/slides/slides-83-websec-0.pdf>, to 
allow a single website be partitioned in multiple pieces. The Extended 
Origin is then going to be protocol+host+port+partition_name. Several 
participants commented that browsers are not going to implement this.
Future discussion should be taken to the mailing list, no consensus to 
work on this in the WG so far.

Some quick refresher about FRAME/X-FRAME drafts ("don't put content of 
this site into a HTML Frame unless ...").
Chairs will ask on the mailing list to accept these drafts as WG drafts.
Some questions of whether this should be done in IETF or W3C. Several 
people (including W3C liaison and the responsible AD) commented that 
doing this in WebSec is fine.

Chairs also quickly talked about MIME sniffing (an editor and reviewers 
are needed) and CSP header field registration draft, which will be done 
in W3C with reviews requested from WebSec and HTTPBIS IETF WGs.