Re: [secdir] Secdir last call review of draft-ietf-capport-api-07

Thanks for the review, Robert!
I filed a No Objection ballot with some suggestions for how to improve the
discussion of TLS usage/configuration, and a couple of pedantic errors in
the HTTP and JSON usage.
(Roman filed a Discuss ballot to try and clarify the API server vs.
web-portal terminology/discussion, including which one is likely to get
PII.)

-Ben

On Thu, Apr 30, 2020 at 08:00:14AM -0700, Robert Sparks via Datatracker wrote:
> Reviewer: Robert Sparks
> Review result: Ready
> 
> I have reviewed this document as part of the security directorate's ongoing
> effort to review all IETF documents being processed by the IESG. These comments
> were written primarily for the benefit of the security area directors. Document
> editors and WG chairs should treat these comments just like any other last call
> comments.
> 
> This document is ready for publication as Proposed Standard RFC.
> 
> The document defines an HTTP json-based API for clients to use with a captive
> portal API server. Discovery of the API server URL is defined in other capport
> documents. Connection to the server uses TLS. Server authentication SHOULD use
> OCSP stapling, and the network SHOULD provide permit connection to NTP servers
> (or other time-sync mechanisms). The security considerations section calls out
> the potential risk of look-alike characters being used in the server domain
> name to mislead the user of the client of this API.
> 
> 
> 
> _______________________________________________
> secdir mailing list
> secdir@ietf.org
> https://www.ietf.org/mailman/listinfo/secdir
> wiki: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview