IETF Logo Mail Archive

[Web-bot-auth] Re: What does draft-meunier-webbotauth-httpsig-protocol do?

Ben Schwartz <bemasc@meta.com> Wed, 15 July 2026 18:31 UTC

Return-Path: <prvs=5656736eb7=bemasc@meta.com>
X-Original-To: web-bot-auth@mail2.ietf.org
Delivered-To: web-bot-auth@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id F1ED5117557B5 for <web-bot-auth@mail2.ietf.org>; Wed, 15 Jul 2026 11:31:33 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1784140294; bh=35sEbMmt58TyGHxVM7bfx6J5DYobugAGdi/A3Y5LAzM=; h=References:In-Reply-To:From:Date:Subject:To:Cc; b=ayA/2fqoRbizhvSAiKR3o9RppKF0Fe0htGcJ7Tbu6S/kruSHBbcmBL1mfDElH7Cer Zb5piHkgoqh+OVecM88VpZZdCMoE9IAQxpZs3wXQ58W5I8ZqFFl7dK8fB/64YEmzSa CI6LbDV4VjzwcpzekE0y5RW23vOoCSRUe1ILxEvw=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.794
X-Spam-Level:
X-Spam-Status: No, score=-2.794 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=meta.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Kd9fHPdrNAr3 for <web-bot-auth@mail2.ietf.org>; Wed, 15 Jul 2026 11:31:33 -0700 (PDT)
Received: from mx0a-00082601.pphosted.com (mx0a-00082601.pphosted.com [67.231.145.42]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id C136D11755711 for <web-bot-auth@ietf.org>; Wed, 15 Jul 2026 11:31:22 -0700 (PDT)
Received: from pps.filterd (m0109334.ppops.net [127.0.0.1]) by mx0a-00082601.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66FHWVKm670740 for <web-bot-auth@ietf.org>; Wed, 15 Jul 2026 11:31:14 -0700
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=meta.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=s2048-2025-q2; bh=2JwolgLjuh54PjGpsENV05CHVzisfr2sHIHBxEW7vbk=; b=tjhsQhv2foQx tfgFNBOAvhubOevzxOnxMymO1OYV4dHruSLmq0qxIEOn+5RGtEni1pUfb+nWp+E9 TC+gwq/NVtKDg8oHuKzK7tqgqISclbjXbNAp+RJA5GyvTzyLrCU2f9kEpMioGaM4 3OaLkKSxRdKwazJ4wK3SNraEUf7cuojCAAzjU7ASSTDw9L0JWXfVN9xPO68i6PXO tvZWgvLCExkWMA8mYnrCoX7TdzGAfQwpCOT8mf7z4UQglzRTtnDO7v3LOMn2/tN3 uUkyAhOM2uiwCH7+YUX1ljVa9yRZw2wfEZsoEP3qEhp5x1LWAnEbJG9zJH8Yngbk hBHaY5GsTw==
Received: from mail-yw1-f200.google.com (mail-yw1-f200.google.com [209.85.128.200]) by mx0a-00082601.pphosted.com (PPS) with ESMTPS id 4fdrhvgghg-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for <web-bot-auth@ietf.org>; Wed, 15 Jul 2026 11:31:14 -0700 (PDT)
Received: by mail-yw1-f200.google.com with SMTP id 00721157ae682-81e6bb29581so5666107b3.2 for <web-bot-auth@ietf.org>; Wed, 15 Jul 2026 11:31:14 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1784140274; cv=none; d=google.com; s=arc-20260327; b=DeLBKQQTOpKmGYKwq/IihxmRl+BJ3BKnj//qEv4WrSXdKCpPYX5epEjLZybMFuQbc0 nJduhYfafV2Qrc48NOtQUad/nRrla+v19I5B1r0SpdAJYREd60YDPErwPF/VNje99rtp B1UKYMzpP9QxPcKKE8wvQM+rBuqY4ExT53ucV+B9DRCPGGsYvl7b4WDwWsdNWJ9A3GW9 mcm+p5+fekZePcFW/jcaESLLh6HWF8t79SgeNYGxT+vpzaXA6TsvHnmmOO9V+YtGyZO1 9wII9TCBaXVcuGn5Pe1lGEux/K9dyHbL9lg8EUzYZYnQEN4r6Qd91jlzqWGU5rsuQPQH mc5g==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version; bh=2JwolgLjuh54PjGpsENV05CHVzisfr2sHIHBxEW7vbk=; fh=ILlz7BHbNJYX3uz3fNOZCWbwk+U6EtwpHtJYPOFPE4M=; b=Gi4sf+oMmrtI87pN2cVa6ZRiBgy+bT//28txqVOpFXmX0WzB5qYbG1WFbKtK9B9WLm 0dNpAoJxgEwaHPnY4l6eYTf7fAT1WuJneXuG/Xu9lzhhko2RJYNgxB4MaFo/23WoOQD9 a4BnWbqzIH4M6QYKnnFv1/fLy2igxyfZnen83q7BtE/5XpM7yGApgXSbINS81DMOMWke gOb6qWmRphuNSod+Td73pFkTafnLYhijVZ17eyo2U0S6Y3JT/I+V255iZCvOyb5v2+NU UHzohvZll2OgBzegsEB5wrJRbT9r+sbBUqJFus1xGQd6qIPb1idI/pUr/NcQqJz8I+0p Jetw==; darn=ietf.org
ARC-Authentication-Results: i=1; mx.google.com; arc=none
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784140274; x=1784745074; h=content-transfer-encoding:content-type:cc:to:subject:message-id :date:from:in-reply-to:references:mime-version:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=2JwolgLjuh54PjGpsENV05CHVzisfr2sHIHBxEW7vbk=; b=AEEOlSM+53iKdURqobdy7x3XXseQ5A3qPuvcNpueUewrXPfWGAmkT4u6fq1AHoi0ym 1oYP9ZH+I+d2jm+125MOScpkJsxUgCwbZyDSb94vcsYd4+0VsMUGnwQw7t95cGiEgZgM Q82muolcv1L0ASsrjO8PkwLIAfmxnW08YeaTw70u8PwPi/KRBdyUaE5IexWRVXWFlfBW ov0Gw+EOYStmOq7T3aklbvC8fypaImwinCAxJoYafvSansMCl5OkrK/8gbFo9X+amuPx FLxR0AFQZCM6zImuxmvdJGaaQBCauy0d7XJC6rjIlo1ewcZa4v/Ij9Z6rfezlnk5OFIG asoQ==
X-Gm-Message-State: AOJu0Yzw5UzqyFBusefvjBeuK1Wj86IwY43SEKzQNCdAlK4eeNhHZ8cf +SYsKqof7QO+5WXy5HH6Bo3DeYzH+lfz6U9Z08w4LsVH6k043HlD7xDr4V0irzBsGn9odQa1p0A 9212GYgvoXSjsuTjfqlFPVq/m4AtWu4oqTQ0jh15wIeoKcy21bVD85UYpMzgoJhVga3gE2/wnax RlmmebwbBLLrjSuWK6Xb3GPmJ+aLw7PY3rCLy8vA==
X-Gm-Gg: AfdE7ckrRNp564akEN0etk050u4PBTBs5XRDsYG12baX26OevkiNSYGeuXz/SoQUVPG acOGkBTGpf2KLFV9Bnupvl8+nLOgbse7deEOpYD80zSZTULjP2ObM0bHTez/MCQXuwdPQ5jLG5d MKvNcSWfixvigHDmDBxTsK9w/ph+DtrKhvr0//y7i6BTYxOkZflmPLdTNbO0V/rnIvNHwjct+Ho 01trKu/xAg=
X-Received: by 2002:a05:690c:ed0:b0:80c:85e5:872f with SMTP id 00721157ae682-81ecfb11d0amr31640367b3.61.1784140273531; Wed, 15 Jul 2026 11:31:13 -0700 (PDT)
X-Received: by 2002:a05:690c:ed0:b0:80c:85e5:872f with SMTP id 00721157ae682-81ecfb11d0amr31639727b3.61.1784140272660; Wed, 15 Jul 2026 11:31:12 -0700 (PDT)
MIME-Version: 1.0
References: <a7aaf631-62b5-41e5-ac8c-afcc77315010@app.fastmail.com> <CAD9ie-ub73p9H+O4es9bXZc_kKR05SPC6j5CLYg29yM2g0YreQ@mail.gmail.com> <6Uh4o62syQCrUGBgIvGWY8p2XuJnR2g2-t-ytwufIobpatO6CIxbQbQdjP72y97wKlDNsiKYruCVCJmh2mFYqg86rIHhwAl2B6P2n1GqBAQ=@thibault.uk> <CABcZeBO+Ex0LaEQhG7_uG2AgnpCMx3-9DaJ4s5KLWpp7Z5nCuA@mail.gmail.com> <CA+kObRL2Xe1AJu+jjiMyM8FVUG-f_NMTegg40ofZP0unXpBynA@mail.gmail.com>
In-Reply-To: <CA+kObRL2Xe1AJu+jjiMyM8FVUG-f_NMTegg40ofZP0unXpBynA@mail.gmail.com>
From: Ben Schwartz <bemasc@meta.com>
Date: Wed, 15 Jul 2026 14:31:01 -0400
X-Gm-Features: AUfX_myDG4fDJxLy9awLFO-1WXRYX6cluvFswyxtFIWGDUgHFzYaAfdA5ku6zKY
Message-ID: <CAOdQrVOk74Firimb3g=9kty+aLkNAA2UGrFZUhEA5M2zahXKGQ@mail.gmail.com>
To: Kaveh Ranjbar <kaveh=40whisper.security@dmarc.ietf.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Proofpoint-GUID: ASY23FR4qgRRPTZYnrgBHZgLDOmF1cmT
X-Proofpoint-ORIG-GUID: ASY23FR4qgRRPTZYnrgBHZgLDOmF1cmT
X-Authority-Analysis: v=2.4 cv=eYQNubEH c=1 sm=1 tr=0 ts=6a57d1f2 cx=c_pps a=NMvoxGxYzVyQPkMeJjVPKg==:117 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=7x6HtfJdh03M6CCDgxCd:22 a=crHB47gyY4rKiduisYu9:22 a=48vgC7mUAAAA:8 a=y6UxDuy1ffnvvFSTTo8A:9 a=QEXdDO2ut3YA:10 a=zgiPjhLxNE0A:10 a=ZXulRonScM0A:10 a=kLokIza1BN8a-hAJ3hfR:22
X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzE1MDE4NCBTYWx0ZWRfXznz3Eeo7VxzH 6PKgArgED5zj60zBWZEtdNbvCjK+L497A+BkuCqx3gHeJS9x6n/m7UQS+ZktZmPGwX95PfySFoo +WGZ5DnALztNb3u2mBKJqQpfyfYhUvLhJOpHIPU5zyek/HtSUe94fSGCRB5oqhuz70EaqdwvvHj jUu3t++IU3uKex1lA75ewrxhesr6ewVSgiI9ftJsEeaaApheNpMMOTQJOKB8Qh0tIRXYcW1dzsN xOSyUbCHC+Ch+ub6Fe5SoOpzHATbqNug+gVwGzVzQBnMRRL3cDHR/PpMdEoLP42Qo2rUgvhxyta I20+R2U1DKKNPQvPuXYIAfaxEQLiCGyOH5G/FFh1S0ME9/BaaUSmLJVUu1ghQ5ueRQGcjPXyA67 GDaDu3uYFCDN0VT7Guj5VKSegPjISDXm9HYanCupSz4GT/iBamDXfwrDbfiHiqwJ5TS0JsGvjrl EHPqQ9cI3aujGlKCBsw==
X-Proofpoint-Spam-Info: AW1haW4tMjYwNzE1MDE4NCBTYWx0ZWRfXw+nC9baDQhM5 Tj5fv2r1iaNBvIwgJF5xN1u0UJRcMik7H6LaOJ06x5oNq3795K9AuWtdKa5yzThCrw5fcGEVHVe bJGCWL4IyG7hY2CGD5CpBnl3+onG9rc=
X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-15_04,2026-07-15_02,2025-10-01_01
Message-ID-Hash: YYAYELWILQ5KWBKUFP5VQTOILL5B5TKA
X-Message-ID-Hash: YYAYELWILQ5KWBKUFP5VQTOILL5B5TKA
X-MailFrom: prvs=5656736eb7=bemasc@meta.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: web-bot-auth@ietf.org
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [Web-bot-auth] Re: What does draft-meunier-webbotauth-httpsig-protocol do?
List-Id: Authentication of non-human users to human-oriented Web sites <web-bot-auth.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/web-bot-auth/ZinrmBvX75vX3XeL6tquxdkopAo>
List-Archive: <https://mailarchive.ietf.org/arch/browse/web-bot-auth>
List-Help: <mailto:web-bot-auth-request@ietf.org?subject=help>
List-Owner: <mailto:web-bot-auth-owner@ietf.org>
List-Post: <mailto:web-bot-auth@ietf.org>
List-Subscribe: <mailto:web-bot-auth-join@ietf.org>
List-Unsubscribe: <mailto:web-bot-auth-leave@ietf.org>

On Wed, Jul 15, 2026 at 12:11 PM Kaveh Ranjbar
<kaveh=40whisper.security@dmarc.ietf.org> wrote:
> But tie-back to a real-world operator, the "allow company X's bots, block company Y's" case, is exactly what the WebPKI cannot give you: a domain-validated certificate proves control of a name, not who operates it.

DNSSEC also proves control, not abstract "ownership".  In practice, it
is common for domain owners to delegate their name to a DNS service
provider who holds the DNSSEC signing keys, just as it is common to
delegate HTTP origins to an HTTP service provider who holds the TLS
signing keys.

DNSSEC and TLS/WebPKI are not different in this way.

I _do_ think DANE is appealing for some server-to-server
authentication use cases, but not when the rest of the transaction is
secured under WebPKI, as in the proposed scope of this work.

--Ben Schwartz

v2.46.0 | Report a Bug | By Email | System Status