[websec] HTTP-Auth BoF meeting in Atlanta

Yoav Nir <ynir@checkpoint.com> Tue, 02 October 2012 10:27 UTC

From: Yoav Nir <ynir@checkpoint.com>
To: "IETF WG (websec@ietf.org)" <websec@ietf.org>
Date: Tue, 02 Oct 2012 12:27:41 +0200
Thread-Topic: HTTP-Auth BoF meeting in Atlanta
Thread-Index: Ac2ghvCoJnFQnW3RREKTP8LDlNm3qA==
Message-ID: <006FEB08D9C6444AB014105C9AEB133F017A7FA6F452@il-ex01.ad.checkpoint.com>
Accept-Language: en-US
Content-Language: en-US
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Subject: [websec] HTTP-Auth BoF meeting in Atlanta
Precedence: list

Hi all

In Vancouver, the httpbis working group declined to adopt any of the proposed authentication schemes. 

In the coming IETF meeting, the security area is going to have a BoF with the intention of forming a working group to create a bunch of experimental RFCs for new authentication methods in HTTP.

There are quite a few proposed methods. Follow this URL to see a list: http://trac.tools.ietf.org/wg/httpbis/trac/wiki/HttpAuthProposals

If you are interested in this topic, we'd be happy to see you in the BoF.  One thing that I think is missing from the discussion is the UI implications of authentication at the HTTP layer. It has been suggested that UI issues are the reason for the relatively sparse deployment of HTTP layer authentication, but I don't think the current discussion has been informed by UI experts who could tell us what future authentication methods should do in terms of UI to gain meaningful deployment. If you or someone you know has such expertise and would be willing to speak at the Atlanta BoF, please contact Derek Atkins and me offline.

Yoav
(with BoF chair hat on)

[websec] HTTP-Auth BoF meeting in Atlanta Yoav Nir