Re: [webfinger] Automated Service Configuration now uses webfinger

[Peter Saint-Andre <[e-mail]>]

On 7/8/13 2:03 PM, Jesse Thompson wrote:
> 
> 
> Peter Saint-Andre <[e-mail]> wrote:
> 
> On 7/8/13 7:12 AM, Jesse Thompson wrote:
>>>> On 7/5/13 9:17 AM, Cyrus Daboo wrote:
>>>>> Hi folks, I have recently posted a new version of the Automated
>>>>> Service Configuration draft (formerly known as Aggregated Service
>>>>> Discovery): 
>>>>>
> <https://datatracker.ietf.org/doc/draft-daboo-aggregated-service-discovery/>.
>>>>>
>>>>>
>>>>>
> This protocol now makes use of webfinger to "bootstrap" discovery of
> the
>>>>> config document. Hopefully it will serve as a useful example of
>>>>> how webfinger can be used by specific applications. I would
>>>>> appreciate feedback from the webfinger community on how we have
>>>>> gone about using webfinger, thanks.
>>>>
>>>> Since "the target FQDN is not in the queried domain" will apply to
>>>> the vast majority of email/calendar domains (hosted by Google,
>>>> Microsoft, etc):
>>>>
>>>> When it comes to practical implementation, essentially no clients
>>>> will bother to "verify with the user that the link URI target FQDN
>>>> is suitable for use before executing any connections to the host", 
>>>> especially if they already have an auto-config scheme that doesn't 
>>>> prompt the user (e.g. Thunderbird).
>>>>
>>>> It might be beneficial to the adoption of this standard to bake in
>>>> a method of secure delegation that could work from day one.
> 
> Hi Jesse, do you have anything in mind?
> 
> One option might be POSH:
> 
> http://datatracker.ietf.org/doc/draft-miller-posh/
> 
> However, if the original query to the service domain goes to an HTTPS
> URI, then following a redirect from there to an HTTPS URI at the
> target domain seems like a form of secure delegation to me. That's the
> same model that Matt Miller and I outline in the POSH draft.
> 
> If I've misunderstood your comment, please do let me know. :-)
> 
>> Yes, I was assuming that would be a good option. 

OK, so we might want some text about that, which probably could be
borrowed or adapted from the POSH document.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/