Re: [secdir] Secdir review of draft-op3ft-leaptofrogans-uri-scheme-03

[Benjamin PHISTER <[e-mail]>]

Dear Magnus,

Thank you for your review, and please excuse my late reply.

I have responded to your questions directly in your message below.

Best regards,

Ben

-- 
Benjamin Phister
Head of Technical Specifications
[e-mail]

OP3FT
6 square Mozart
75016 Paris - France
Tel: [phone]
https://www.op3ft.org/
frogans*op3ft


------------------------------------------------------------------------
*From:* Magnus Nyström <[e-mail]>
*Subject:* Secdir review of draft-op3ft-leaptofrogans-uri-scheme-03
*Date:* Friday, Nov 16, 2018 9:47 AM CET
*To:* [e-mail], [e-mail]

> I have reviewed this document as part of the security directorate's 
> ongoing effort to review all IETF documents being processed by the 
> IESG. These comments were written primarily for the benefit of the 
> security area directors.  Document editors and WG chairs should treat 
> these comments just like any other last call comments.
>
> This document specifies the "leaptofrogans" URI scheme. Its security 
> considerations section provides a discussion of common URI risks and 
> how they apply to the frogans URIs. I do wonder a bit about the 
> statement that "[the] risk of confusion i[due to the true address 
> being hidden in the link text visible to the user] is mitigated 
> because Frogans Player must always display the real Frogans address 
> contained in the URI" - does this necessarily also apply to "inbound" 
> direction cases - i.e., when a regular browser displays a link which 
> allows the user to launch a frogans site?

The way that end-user applications (such as a Web browser or an E-mail 
client) choose to display links is outside the scope of this I-D. The 
I-D only says what Frogans Player must do when dealing with a 
'leaptofrogans' URI. It does not say what other end-user applications 
must display when dealing with a 'leaptofrogans' URI.

Furthermore, the way end-user applications display links varies 
considerably. The real Frogans address contained in the URI may not be 
displayed at all. For instance, on a Web page, a link can be presented 
using an image instead of using a hypertext link.

In any case, as discussed in the I-D, the risk of confusion is mitigated 
by Frogans Player that always displays the real Frogans address 
contained in the URI.

>
> (Unrelated, the "leaptofrogans" name seems long. The scheme part of 
> URIs is typically the name of a protocol or similar. In the frogans 
> case, "fsdl" comes to mind as iI understand it to be the language used 
> to create frogans sites (I do not know what protocol is used to 
> commuicate with such sites).)

The choice of the scheme name is discussed in Section 3 ("The Choice of 
the Scheme Name") of the I-D.

Choosing 'fsdl' as the scheme name would not work because FSDL, the 
Frogans Slide Description Language, relates to the format of the 
documents representing the slides of a Frogans site and does not relate 
to its Frogans address (just like HTML relates to the format of 
documents representing the pages of a Web site and not to their URLs).

Concerning the protocols used by Frogans Player for requesting and 
receiving data from the server hosting the Frogans site: As of version 
3.0 of the FSDL technical specification 
(https://www.frogans.org/en/resources/fsdl/access.html -- see Section 
1.2 "Purpose"), FSDL works on top of Uniform Content Server Request 
(UCSR), a new framework designed and developed by the OP3FT to make the 
Frogans technology independent from data-transport protocols. The UCSR 
framework provides a client application with an abstraction layer for 
uniformly requesting and receiving data from a content server, while 
ensuring a predetermined security level. Note that UCSR does not propose 
new networking protocols. It utilizes existing protocols widely used on 
the  Internet such as IP, DNS, TCP, TLS, and HTTP. For more information 
on UCSR (and also to get an overall understanding of the Frogans 
technology), see Frogans Technology Overview on the official Web site of 
the Frogans technology 
(https://www.frogans.org/en/resources/overview/access.html).

Choosing 'ucsr' as a scheme name would not work either because UCSR can 
be used in contexts outside Frogans technology.

> Thanks,
> -- Magnus