Re: [websec] new rev: draft-ietf-websec-strict-transport-sec-06

Peter Saint-Andre <> Mon, 26 March 2012 06:39 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 7FA6421F8474 for <>; Sun, 25 Mar 2012 23:39:21 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -106.599
X-Spam-Status: No, score=-106.599 tagged_above=-999 required=5 tests=[AWL=-4.000, BAYES_00=-2.599, USER_IN_WHITELIST=-100]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id 0a-j2PfP8VMW for <>; Sun, 25 Mar 2012 23:39:20 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id 9BDA221F8470 for <>; Sun, 25 Mar 2012 23:39:20 -0700 (PDT)
Received: from (unknown []) (Authenticated sender: stpeter) by (Postfix) with ESMTPSA id 0C4EA4005B; Mon, 26 Mar 2012 00:52:18 -0600 (MDT)
Message-ID: <>
Date: Mon, 26 Mar 2012 08:39:17 +0200
From: Peter Saint-Andre <>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.5; rv:11.0) Gecko/20120313 Thunderbird/11.0
MIME-Version: 1.0
To: =JeffH <>
References: <>
In-Reply-To: <>
X-Enigmail-Version: 1.4
OpenPGP: url=
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Cc: IETF WebSec WG <>
Subject: Re: [websec] new rev: draft-ietf-websec-strict-transport-sec-06
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Web Application Security Minus Authentication and Transport <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 26 Mar 2012 06:39:21 -0000

Hash: SHA1

On 3/26/12 6:22 AM, =JeffH wrote:
> [ this msg is a tad late, -06 was pub'd on 12-Mar, apologies.
> Sending it for the record. ]

Hi Jeff, thanks for addressing my earlier comments. I found time to
read -06 on the flight to Paris. Here are some small comments.

Section 1:

   This specification also incorporates notions from [JacksonBarth2008]
   in that policy is applied on an "entire-host" basis: it applies to
   all TCP ports of the issuing host.

Please make it clear that all TCP ports does not mean all application
protocols, only HTTP on all ports where it might be offered (not only
the ports registered with the IANA).

Section 7.2

Does is make sense to mention that status code 308 might be
appropriate in certain circumstances? See draft-reschke-http-status-308.

Section 8.4

The HTTP-Equiv <Meta> Element Attribute is defined in the HTML
specification, so a reference would be helpful.

Section 9

The phrase "valid Unicode-encoded string-serialized domain name" seems
a bit strange, because we don't typically refer to Unicode as an
encoding scheme. See RFC 6365 regarding such terminology.

Section 11.1

I think the text about "no user recourse" conflates two things:
showing a warning, and allowing the user to click through: "the user
should not be presented with an explanatory dialog giving her the
option to proceed." Would it be OK for a user agent to show an
explanatory dialog but not provide an option to proceed? Is there a
security reason to fail the connection without any explanation?

Section 11.5

The note it worded a bit oddly (e.g., "it shouldn't be possible for an
attacker to inject script..." might be better worded along the lines
of "implementations need to guard against alowing an attacker to
inject script...").


- --
Peter Saint-Andre
Version: GnuPG v1.4.8 (Darwin)
Comment: Using GnuPG with Mozilla -