Re: [v6ops] new draft: draft-vyncke-v6ops-happy-eyeballs-cookie

A few comments on this

" 5.  Potential Mitgation"

 -  Obviously, correct the spelling of Mitigation.
 -  IMHO, I would remove the word "Potential".  (See below)

" 7.  Security Considerations"

 -  I would qualify the first phrase by rewording somewhat like as follows, (or remove the phrase altogether):
The association of the session cookie with the user-agent IP address has some security value as it can help prevent "session cookie stealing" in some limited situations...
 -  It should be understood that the desire to protect a cookie from cookie stealing often implies that a potential attacker has already gained access to the cookie, and is close enough in proximity to the transmission path(s), or endpoints, that any assumptions, about the attacker's address always being different, are no longer valid assumptions; even without a man-in-the-middle attack.  NAT, mobile devices, and server hosted client apps are all examples of situations where addresses can be shared and/or swapped between multiple users.  I would think that exchange of random keys at the beginning of session establishment, along with some type of validation algorithm, is a much better way to address this type of security consideration than using an address as the key.

- Dan

> -----Original Message-----
> From: v6ops [mailto:v6ops-bounces@ietf.org] On Behalf Of fred@cisco.com
> Sent: Wednesday, February 11, 2015 6:47 AM 
> To: v6ops@ietf.org
> Cc: draft-vyncke-v6ops-happy-eyeballs-cookie@tools.ietf.org
> Subject: [v6ops] new draft: draft-vyncke-v6ops-happy-eyeballs-cookie
> 
> A new draft has been posted, at http://tools.ietf.org/html/draft-vyncke-v6ops-
> happy-eyeballs-cookie. Please take a look at it and comment.
> 
> _______________________________________________
> v6ops mailing list
> v6ops@ietf.org
> https://www.ietf.org/mailman/listinfo/v6ops