[Webpush] Kathleen Moriarty's No Objection on draft-ietf-webpush-protocol-11: (with COMMENT)

["Kathleen Moriarty" <[e-mail]>]

Kathleen Moriarty has entered the following ballot position for
draft-ietf-webpush-protocol-11: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-webpush-protocol/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thank you for a well written security considerations section. 

The only thing I might add is a note on the varying levels of security
offered by the HTTP authentication methods, which are documented in their
RFCs.  Adding just that point to the following (phrased however you'd
like) would be helpful:
    A push service MAY
   choose to authorize requests based on any HTTP-compatible
   authorization method available, of which there are numerous options.

The somewhat recent updates to Basic & Digest do a really great job at
saying how awful they are and there are some experimental options that
offer some promise now.