Re: [websec] CRIME II alleged at Black Hat

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

[I posted this mail also the CA Browser Forum list but it is read-only for non-members only. So, I post it here.]

Hi Phil, 

I am always a bit reluctant when I hear about these types of attacks. In many cases, they are very basic and make various assumptions. In the OAuth working group we had looked into various attacks and many of them turned out to be an implementation flaw: someone tried to make some short-cuts and then had to pay the price for it. The most recent example was Facebook earlier this year. 

So, I am looking forward to see the details of this attack. 

If you know the speakers maybe it is possible to get in touch with them upfront. 

Just saying move away from bearer tokens is certainly simplistic for a number of reasons. 

Ciao
Hannes

On Jul 2, 2013, at 4:52 PM, Phillip Hallam-Baker wrote:

> http://www.darkreading.com/vulnerability/https-side-channel-attack-a-tool-for-enc/240157583
> 
> We do not have the details yet. But it seems like this will be yet another variant of the 'in the browser' adaptive plaintext attack against SSL enabling cookie stealing.
> 
> There are two problems we need to fix:
> 
> 1) Whatever the latest SSL issue is.
> 
> 2) Stop using bearer tokens for authentication.
> 
> 
> I anticipated this attack (it is the third time round after all) which is why I wrote the session ID scheme as a drop in replacement for cookies. In the short term sites would have to support both schemes as a transitional measure but given the current transition to HTML5 it is entirely likely that some sites can force a transition sooner.
> 
> http://www.ietf.org/id/draft-hallambaker-httpsession-01.txt
> 
> 
> -- 
> Website: http://hallambaker.com/
> _______________________________________________
> websec mailing list
> websec@ietf.org
> https://www.ietf.org/mailman/listinfo/websec

-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.19 (Darwin)
Comment: GPGTools - http://gpgtools.org

iQEcBAEBCgAGBQJR0uX7AAoJEGhJURNOOiAtn2kH/1EVIvEm07+TG0BHqYuRuuzz
9JsWp4CdECuH3H4Zj+B3a5wrY6XsUxxmTaceC94S82YuV0jy/8wS8vBeeIuF2PU/
FUwTFDoJ8zVdRtPNNRsbLTwc7n/Jg8Hz477wb4CXllfgcqci4ADuihJW6WkaiqNX
l/4h0mqIfFOeQ3q7km5BZuZrrD/UbxM4r231tJRxhJL5QKyH8I3e63gtUlBMwW0g
nONH3NdoCGoXLiQT9E6YAzCzFQBbb1+UsJbkQ+N8kW+2GtOVdf5caxX6EtuThYuW
68MGKhDbFQZk1dSwLvxzX6sgak020h7o6DJJDlBJLG/jlPlF3KESYmV6LXSaIRo=
=RS6A
-----END PGP SIGNATURE-----