Re: [Webpush] Authorization to send messages

[Martin Thomson <[e-mail]>]

On 5 March 2015 at 11:33, Benjamin Bangert <[e-mail]> wrote:
> In webpush http2-02, section 8.3 Authorization doesn't mention how the Push
> Service should deal with authenticating an Application Server wishing to
> send messages. From conversations I've heard, it does sound like all major
> vendors plan on requiring Application Server's to provide some form of
> authentication/token as GCM/APNS/etc already do.

It has always been my view that knowledge of the endpoint is necessary
and sufficient here.  But I've gained a more nuanced view over time.

In particular, Costin has suggested that we build a system whereby a
sender can register, thereby establishing a continuous, if
pseudonymous, identity.  That helps with DoS mitigation strategies,
largely because the Push Server can build up a reputation for each
identity over time.