Re: [TLS] Deprecating SSLv3

[Nico Williams <[e-mail]>]

On Tue, Nov 25, 2014 at 12:29:41AM +0200, Yoav Nir wrote:
> I don’t know about Martin, but the thing that bothers me most about
> cookies is not that they’re bearer tokens or that they’re a lucrative
> target for attacks, but the fact that they can freely be used by
> attackers.
> 
> CRIME, BEAST, POODLE, they all depend on my browser going to
> http://www.attacker.com, and then a script loaded from that site
> running on the browser, sending requests to Facebook and google and
> the like with *my* cookies. For some reason these requests are treated
> as if they come from *me* rather than the attacker. They call it CSRF,
> but it’s not really forgery. It’s just the way the web is built.

Oh sure, and I agree fully, we could totally have a bash-the-web-
security-model thread :) but we can't really do anything about it from
TLS WG.

> If I had to choose between “new cookie” that is not a bearer token but
> is somehow bound to session or origin and a “new cookie” that is
> scoped so that only scripts loaded from *.google.com can use my

And DOM elements (but I repeat what you said).

> google.com cookie while other scripts send unauthenticated requests,
> I’d choose the scoping.

+1e6.  After all, we can improve TLS's protection to bearer tokens, but
we can't really help the web security model much more than that from
here (here == TLS).

Nico
--