Re: [saag] Comments on draft-foudil-securitytxt-04

[Paul Wouters <[e-mail]>]

On 01/08/2019 01:05 AM, Randy Bush wrote:
>> This proposal is addressing item #3 - all it is providing is a simple
>> way for an organization to publish a security reporting policy on
>> their website in a standard, machine-parsable way, and stored in a
>> standard location. It is certainly not claiming to be more secure than
>> that approach, but at the same time it not less secure than publishing
>> this information on a website directly like it is done today.
> 
> https is pretty widely deployed.  most of the searches you enumerated
> are tls protected today.  this proposal goes against that for no good
> reason.  if this is not fixed, on last call i will stand with tim and
> just shoot the damned horse.

This does not make sense to me. If you are presenting security.txt for an HTTP
resource, it will naturally be served over HTTP, not HTTPS. The whole point
of this thing is that it is present on the resource itself, not somewhere else[.*]

If http://example.com is compromised, and you grab http://example.com/security.txt,
then whether the content of security.txt points to an HTTP or HTTPS resource is
meaningless.

You already lost on the initial unprotected download of security.txt (be it by
server compromise or active network attacker)

You can't have your horse and shoot it too.

Paul
[*] If you want the security of "somewhere else", you should have started to
look there in the first place.