Re: [secdir] SECDIR review of draft-ietf-httpbis-p7-auth-24

[Julian Reschke <[e-mail]>]

Hi Stephen,

On 2013-10-30 15:32, Stephen Kent wrote:
> ...
>>> The SC section here addresses only two issues: purging credentials in
>>> clients and user agents, and protection spaces. The discussion of the
>>> former topic does not discuss how credential purging applies to proxies.
>>
>> As per httpbis-p1, a proxy is a client as well ('An HTTP "client" is a
>> program that establishes a connection to a server for the purpose of
>> sending one or more HTTP requests.' --
>> <http://greenbytes.de/tech/webdav/draft-ietf-httpbis-p1-messaging-24.html#rfc.section.2.1>).
>> Does this address your comment?
> yes, but it might be clearer to note this, parenthetically, in this doc.
> For example, page 5 includes the following text:
>
>     The 407 (Proxy Authentication Required) response message is used by a
>
> proxy to challenge the authorization of a client and MUST include a
>
> Proxy-Authenticate header field containing at least one challenge
>
> applicable to the proxy for the requested resource.
>
>
> The use of the terms "proxy" and "client" here suggest that they are
> distinct notions,
> not that a proxy is also considered a client.

In the context of this paragraph, the proxy is indeed the server.

>>> Also, it is not clear that a user control for credential purging will
>>> have the desired effect given a potentially complex GUI environment. The
>>
>> Any proposal for enhancing the text?
>
> User agents that cache credentials are encouraged to provide a
>
> readily accessible mechanism for discarding cached credentials under
>
> user control. *We recognize that this may not be a trivial task.**
> **   Designing a UI that will encourage users to purge credentials when**
> **   appropriate, but not cause them to prematurely do so may be difficult.*

In my experience, the implementers of browsers are very aware of the 
problems with coming up with a good UI. I really don't think that adding 
more prose here will help at all. (But hey, I asked for a proposal and 
you sent one; thanks for that!).

> ...

Best regards, Julian