Re: [saag] Comments on draft-foudil-securitytxt-04

[Yakov Shafranovich <[e-mail]>]

On Mon, Jan 7, 2019 at 6:06 PM Tim Hollebeek <[e-mail]> wrote:
>
> I agree that better security contact information is an important problem and
> an admirable goal.
>
> And I agree that there are some threat scenarios where security.txt might
> not be compromised and would be able to be relied upon.
>
> However, there are also many where it would not be wise to rely upon it,
> especially early in an investigation where the true extent of the compromise
> or security issue may be unknown.  And I'm sure that the information would
> inevitably end up being used by many people who lack the sophistication to
> make a reasonable decision about the likelihood of the information being
> trustworthy.
>
> For that reason, I tend to think that security.txt is a rather nasty
> footgun, and quite likely to make the situation worse instead of better.  I
> think time is better spent discussing better solutions to the problem.
>

As of today, there are several places where someone desiring to
contact a security team would obtain such information:
1. WHOIS for a particular domain name or IP address.
2. Emailing "[e-mail]" as per RFC 2142.
3. Trying to locate a disclosure policy or document on the
organization's website.
4. Contacting a CERT or a third party such as HackerOne or ZDI, in
hopes that they have a better way to reach out to a particular
organization.
5. Trying to find someone who works in a security role at a particular
organization via social media such as LinkedIn, and reaching out
directly.
etc.

All of these approaches have their advantages and disadvantages, and
it seems that usually a combination of these actually gets the
reporter in touch with the correct person at an organization.

This proposal is addressing item #3 - all it is providing is a simple
way for an organization to publish a security reporting policy on
their website in a standard, machine-parsable way, and stored in a
standard location. It is certainly not claiming to be more secure than
that approach, but at the same time it not less secure than publishing
this information on a website directly like it is done today.

There are other similar entries in the .well-known registry that use a
similar approach of publishing something in a webspace in order to
achieve a security-related result. Some examples are keybase.txt,
acme-challenge, etc.

Yakov