IETF Logo Mail Archive

Re: [Unbearable] Token binding version (0, 10) support is global on google servers

Andrei Popov <Andrei.Popov@microsoft.com> Fri, 20 January 2017 17:36 UTC

Return-Path: <Andrei.Popov@microsoft.com>
X-Original-To: unbearable@ietfa.amsl.com
Delivered-To: unbearable@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AA2A41293E0 for <unbearable@ietfa.amsl.com>; Fri, 20 Jan 2017 09:36:58 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.157
X-Spam-Level:
X-Spam-Status: No, score=-3.157 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-1.156, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8Hvysw4Q21Wb for <unbearable@ietfa.amsl.com>; Fri, 20 Jan 2017 09:36:56 -0800 (PST)
Received: from NAM01-BY2-obe.outbound.protection.outlook.com (mail-by2nam01on0129.outbound.protection.outlook.com [104.47.34.129]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B088B12943D for <unbearable@ietf.org>; Fri, 20 Jan 2017 09:36:55 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=OfQ719lblmJ7Yxgex7T6jq1nOj7OMiEfZQZwX2mZH9A=; b=JhG/myQweHsoG/QnXWs3MYmu8GQyop4G6va/c5vMg910XVYSft5V5zlGmLBvv1YrGjVs2ciBfWja7zRiASlLOTjxp4BcALONDybXFiqJE8rzFQYmbt60FvPxZjoH02/H0LvLshlhoML/lQZSP1Uq+l7iaIYbIxULNqiEx/AYgGM=
Received: from CY1PR0301MB0842.namprd03.prod.outlook.com (10.160.163.148) by CY1PR0301MB0842.namprd03.prod.outlook.com (10.160.163.148) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.845.12; Fri, 20 Jan 2017 17:36:54 +0000
Received: from CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) by CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) with mapi id 15.01.0845.021; Fri, 20 Jan 2017 17:36:54 +0000
From: Andrei Popov <Andrei.Popov@microsoft.com>
To: Brian Campbell <bcampbell@pingidentity.com>, John Bradley <ve7jtb@ve7jtb.com>
Thread-Topic: [Unbearable] Token binding version (0, 10) support is global on google servers
Thread-Index: AQHScx1jG803qeLKKkijf4Ce8+12zaFBXeUAgAACwICAABtEAIAAI9vQ
Date: Fri, 20 Jan 2017 17:36:53 +0000
Message-ID: <CY1PR0301MB08428BF819199AE377CF352A8C710@CY1PR0301MB0842.namprd03.prod.outlook.com>
References: <CAH9QtQHiMNKTWkExDduH=huCzs=yVW+E7YM3Wnoh0DoeYUe08A@mail.gmail.com> <8074E906-BC37-42BF-8DE3-C2C797D71577@ve7jtb.com> <CAH9QtQFegV+GzL1rRLZoFZ5Wy=6u=FL86AM3EuCrHH8p+PC+YQ@mail.gmail.com> <ED317261-FDFB-4325-B316-B793F61DCCAE@ve7jtb.com> <CA+k3eCRhpGEEnaEBEw0xAYdjxnX7woTaVbdnCPTerQO-VHANbA@mail.gmail.com>
In-Reply-To: <CA+k3eCRhpGEEnaEBEw0xAYdjxnX7woTaVbdnCPTerQO-VHANbA@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com;
x-originating-ip: [2001:4898:80e8:a::1d2]
x-ms-office365-filtering-correlation-id: cbd50cc2-ecd6-4bfe-8768-08d4415aecbf
x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001); SRVR:CY1PR0301MB0842;
x-microsoft-exchange-diagnostics: 1; CY1PR0301MB0842; 7:O6BqePgxRDn/iEe5UGu4D2JTxX0s66i0QbmfN5QRsgRvvMZ7zHtXiiRxPJTXMp0fNjdEu+qCRTQDIM59jivYdA3Oq6O+EAVCTk9Cvbreg8jCUQZVlzVSjoj860nayl6z+ny0+AUVTMtoMVuvdTKFgOm3K8BLdAVmuUz3DKqpqmAk1766aNj3u+Jk1a5qClwNyrLpnCOYGTYftw+oFKHog9bmQs3DDestWu5cwQPCXGo/rvlNFgLhxTHYdLkBd9v2leJGh831sbR03PlAl72l0A/XzdUJluH/BbPpAdo+TxJp3jd1iaUN7u4AHJ8iJPNq68D4QG/dq8FNl4QzTeIrNA/80ziEQ8gOyoY2CvHQZE5IWYiC8vl8yicOah8FW1eWsSfvQwuZoAiVGS8l1qGs9eXpzpGfjza82/yNuBEw+LPoCKxUfSBa5KROtcZV632vg79kpdO5Ajy7wmTQXm7HiWA+vvCFqVgB4RYtwq9qkTU=
x-microsoft-antispam-prvs: <CY1PR0301MB0842B516690C84DF5773C0BE8C710@CY1PR0301MB0842.namprd03.prod.outlook.com>
x-exchange-antispam-report-test: UriScan:(211936372134217)(21748063052155);
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6055026)(61426038)(61427038)(6041248)(20161123555025)(20161123564025)(20161123562025)(20161123560025)(6072148)(6047074); SRVR:CY1PR0301MB0842; BCL:0; PCL:0; RULEID:; SRVR:CY1PR0301MB0842;
x-forefront-prvs: 01930B2BA8
x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(39840400002)(39860400002)(39410400002)(39450400003)(39850400002)(189002)(377454003)(199003)(24454002)(6436002)(106116001)(54896002)(189998001)(8990500004)(236005)(2900100001)(92566002)(68736007)(54906002)(101416001)(33656002)(38730400001)(790700001)(99286003)(2906002)(9686003)(55016002)(6506006)(6116002)(102836003)(54356999)(4326007)(5005710100001)(50986999)(76176999)(77096006)(53936002)(10290500002)(16601075003)(229853002)(5001770100001)(606005)(25786008)(3660700001)(2950100002)(6306002)(8676002)(10090500001)(5660300001)(93886004)(97736004)(8936002)(86362001)(7906003)(86612001)(122556002)(3280700002)(74316002)(81166006)(7696004)(81156014)(7736002)(105586002)(106356001); DIR:OUT; SFP:1102; SCL:1; SRVR:CY1PR0301MB0842; H:CY1PR0301MB0842.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en;
received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts)
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: multipart/alternative; boundary="_000_CY1PR0301MB08428BF819199AE377CF352A8C710CY1PR0301MB0842_"
MIME-Version: 1.0
X-OriginatorOrg: microsoft.com
X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Jan 2017 17:36:53.8265 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR0301MB0842
Archived-At: <https://mailarchive.ietf.org/arch/msg/unbearable/Dq6wndzBuxeCdf7yse5KEc5hIHw>
Cc: Tokbind WG <unbearable@ietf.org>, token-binding-team <token-binding-team@google.com>, Bill Cox <waywardgeek@google.com>
Subject: Re: [Unbearable] Token binding version (0, 10) support is global on google servers
X-BeenThere: unbearable@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" <unbearable.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/unbearable>, <mailto:unbearable-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/unbearable/>
List-Post: <mailto:unbearable@ietf.org>
List-Help: <mailto:unbearable-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/unbearable>, <mailto:unbearable-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 20 Jan 2017 17:36:59 -0000

Ø  We should check if it is on in the Edge preview rings.   I think Andrei mentioned that was about to happen in Korea.
TB v0.10 is enabled by default in IE & Edge on the latest Windows 10 insider preview build.

Cheers,

Andrei

From: Unbearable [mailto:unbearable-bounces@ietf.org] On Behalf Of Brian Campbell
Sent: Friday, January 20, 2017 7:23 AM
To: John Bradley <ve7jtb@ve7jtb.com>
Cc: Tokbind WG <unbearable@ietf.org>; token-binding-team <token-binding-team@google.com>; Bill Cox <waywardgeek@google.com>
Subject: Re: [Unbearable] Token binding version (0, 10) support is global on google servers

chrome://flags/#enable-token-binding AFAIK is where one can flip the flag

On Fri, Jan 20, 2017 at 6:45 AM, John Bradley <ve7jtb@ve7jtb.com<mailto:ve7jtb@ve7jtb.com>> wrote:
Can you remind people in the WG what the flag is.

I think a test page is useful for PR.

The browserauth.net<http://browserauth.net> page run my Dirk should be updated to point to it.

I know that there is a test in the Chromium source but having some public page will encourage testing.

Thanks
John B.

On Jan 20, 2017, at 10:35 AM, Bill Cox <waywardgeek@google.com<mailto:waywardgeek@google.com>> wrote:

On Fri, Jan 20, 2017 at 5:01 AM, John Bradley <ve7jtb@ve7jtb.com<mailto:ve7jtb@ve7jtb.com>> wrote:
Great news.

Is token binding not behind a feature flag for some of the newer builds of Chrome?

It still is behind a feature flag.  Nick Harper is doing a launch to turn token binding on by default, IIUC.

We should check if it is on in the Edge preview rings.   I think Andrei mentioned that was about to happen in Korea.

Do you have any test page that would show if the cookies are successfully token bound ?

I don't think we've built such a page yet.  Would it be useful?

Bill


_______________________________________________
Unbearable mailing list
Unbearable@ietf.org<mailto:Unbearable@ietf.org>
https://www.ietf.org/mailman/listinfo/unbearable

v2.46.0 | Report a Bug | By Email | System Status