Re: [webfinger] Automated Service Configuration now uses webfinger

[John Bradley <[e-mail]>]

In Sec 4.2 WF currently allows redirecting requests from a https: uri to another https: uri.

The problem is mostly domains that don't have any sort of secure web hosting to redirect from.

John B.


On 2013-07-08, at 1:04 PM, Peter Saint-Andre <[e-mail]> wrote:

> On 7/8/13 2:03 PM, Jesse Thompson wrote:
>> 
>> 
>> Peter Saint-Andre <[e-mail]> wrote:
>> 
>> On 7/8/13 7:12 AM, Jesse Thompson wrote:
>>>>> On 7/5/13 9:17 AM, Cyrus Daboo wrote:
>>>>>> Hi folks, I have recently posted a new version of the Automated
>>>>>> Service Configuration draft (formerly known as Aggregated Service
>>>>>> Discovery): 
>>>>>> 
>> <https://datatracker.ietf.org/doc/draft-daboo-aggregated-service-discovery/>.
>>>>>> 
>>>>>> 
>>>>>> 
>> This protocol now makes use of webfinger to "bootstrap" discovery of
>> the
>>>>>> config document. Hopefully it will serve as a useful example of
>>>>>> how webfinger can be used by specific applications. I would
>>>>>> appreciate feedback from the webfinger community on how we have
>>>>>> gone about using webfinger, thanks.
>>>>> 
>>>>> Since "the target FQDN is not in the queried domain" will apply to
>>>>> the vast majority of email/calendar domains (hosted by Google,
>>>>> Microsoft, etc):
>>>>> 
>>>>> When it comes to practical implementation, essentially no clients
>>>>> will bother to "verify with the user that the link URI target FQDN
>>>>> is suitable for use before executing any connections to the host", 
>>>>> especially if they already have an auto-config scheme that doesn't 
>>>>> prompt the user (e.g. Thunderbird).
>>>>> 
>>>>> It might be beneficial to the adoption of this standard to bake in
>>>>> a method of secure delegation that could work from day one.
>> 
>> Hi Jesse, do you have anything in mind?
>> 
>> One option might be POSH:
>> 
>> http://datatracker.ietf.org/doc/draft-miller-posh/
>> 
>> However, if the original query to the service domain goes to an HTTPS
>> URI, then following a redirect from there to an HTTPS URI at the
>> target domain seems like a form of secure delegation to me. That's the
>> same model that Matt Miller and I outline in the POSH draft.
>> 
>> If I've misunderstood your comment, please do let me know. :-)
>> 
>>> Yes, I was assuming that would be a good option. 
> 
> OK, so we might want some text about that, which probably could be
> borrowed or adapted from the POSH document.
> 
> Peter
> 
> -- 
> Peter Saint-Andre
> https://stpeter.im/
> 
> 
> _______________________________________________
> webfinger mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/webfinger