Subject: Re: [webfinger] [apps-discuss] Draft -07 mod proposal: HTTPS only

From: Barry Leiba <[email-masked]>
Date: Wed, 5 Dec 2012 13:18:13 -0500

Please remember to replace [email-masked] with
[email-masked] if you continue this or other webfinger-related
threads.

Barry, App AD

On Tue, Dec 4, 2012 at 2:43 PM, John Bradley <[email-masked]> wrote:
> HSTS doesn't protect against a DNS attack before the client makes first
> contact.   It is intended to prevent leaking https: bound cookies after the
> first contact.
> I don't think it helps us in any way.  An attacker would redirect the client
> to the fake site without HSTS before it makes the WF request.
>
> The certificate verification re RFC6125 per OAuth and other specs still
> needs to be added, rather than just implied.
>
> John B.
>
> On 2012-12-04, at 4:03 PM, Brad Fitzpatrick <[email-masked]> wrote:
>
> On Tue, Dec 4, 2012 at 10:54 AM, Blaine Cook <[email-masked]> wrote:
>>
>> and HTTPS-enabled servers SHOULD use HSTS to ensure that clients are not
>> vulnerable to downgrade attacks.
>
>
> HSTS is a huge hammer and very few sites are prepared to enable it.  I don't
> think it should be a SHOULD, especially because webfinger shares the same
> domain as other things on that host, and WebFinger's use of HSTS would
> influence other paths on that host.  (yes, I already hear the arguments for
> a webfinger subdomain coming back)
>
>> It's worth noting that DNS is still a huge security hole in all of this. I
>> don't see Webfinger mandating the use of DNSSEC, nor the methods by which to
>> verify certificates, so no-one should be under the illusion that mandating
>> HTTPS is going to lead to "secure" implementations.
>
>
> I believe verification of certs with root CAs was implicit.  At least that's
> what (almost?) all HTTP clients do by default anyway.
>
> _______________________________________________
> apps-discuss mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/apps-discuss
>