Subject: web security happenings

From: Peter Saint-Andre <[email-masked]>
Date: Tue, 13 Jul 2010 10:49:20 -0600

Just a quick note to clue folks in to some emerging activity on web
security, mostly in the form of the HASMAT BoF at IETF 78.  The theme
here is better application-level security for the "modern" web, which
uses fun technologies like AJAX but also opens up the possibility for
new attacks (cross-site scripting, cross-site request forgery,
malvertising, clickjacking, and all the rest).

The proposed charter [0] lays out these issues in greater detail, and
three Internet-Drafts [1] [2] [3] are currently being used as input to
the conversation.  If you go in for video, a relevant talk by BoF
co-organizer Jeff Hodges was recorded at the recent Internet Identity
Workshop. [4]

The BoF organizers will hold an introductory / preparatory conference
call tomorrow, July 14, at 16:00 UTC, and all those who are interested
in the intersection of security and the web are welcome to participate
in this call [5] and in the BoF on Tuesday, July 27, at 13:00 local time
in Maastricht. [6]

Thanks!

Peter

[0] http://www.ietf.org/mail-archive/web/hasmat/current/msg00006.html
[1] https://datatracker.ietf.org/doc/draft-abarth-origin/
[2] https://datatracker.ietf.org/doc/draft-abarth-mime-sniff/
[3] https://datatracker.ietf.org/doc/draft-hodges-strict-transport-sec/
[4] http://idcoach.blip.tv/file/3650497
[5] http://www.ietf.org/mail-archive/web/hasmat/current/msg00034.html
[6] https://datatracker.ietf.org/meeting/78/agenda.html

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Tue, 13 Jul 2010 23:26:20 +0200

On 13 jul 2010, at 18:49, Peter Saint-Andre wrote:

> fun technologies like AJAX but also opens up the possibility for

Isn't this W3C stuff?

---

From: Peter Saint-Andre <[email-masked]>
Date: Tue, 13 Jul 2010 15:54:22 -0600

>> malvertising, clickjacking, and all the rest).

Good question. We've had discussions about that with folks from the W3C
and there's broad agreement that we'll divide up the work by having the
IETF focus on topics that are more closely related to HTTP (e.g., new
headers) and by having the W3C focus on topics that are more closely
related to HTML and web browsers (e.g., Mozilla's Content Security
Policy and the W3C's "Web Security Context: User Interface Guidelines"
document).

But the exact dividing line for that division of labor is a good issue
for discussion at the HASMAT BoF.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Thomas Roessler <[email-masked]>
Date: Wed, 14 Jul 2010 09:41:54 +0100

> for discussion at the HASMAT BoF.

+1 to that.

There are pieces to this area of work (e.g., JeffH's proposed Simple Transport Security) that mostly relate to IETF protocols.

There are pieces (like CORS and UMP, aka "cross-site XMLHttpRequest") that are currently at W3C, are on the overlap between protocol work and the browser environment, and would benefit from IETF review.

There are other pieces to this work (e.g., controlling the security policies within HTML5) that seem essentially in scope for W3C.

To me, it indeed sounds like it would be useful to do this sort of work in close coordination between W3C and IETF.

Regards,
--
Thomas Roessler, W3C  <[email-masked]>  (@roessler)

---

From: Cullen Jennings <[email-masked]>
Date: Wed, 14 Jul 2010 16:33:00 +0100

>> malvertising, clickjacking, and all the rest).

It's important stuff - if they are not making progress on it, some SDO with people that have skill and expertise in this area should do work on it. A BOF is a great way to find out if we have people with the expertise and the  interest to do work. My gut feeling is that we probably do.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Thu, 15 Jul 2010 14:22:33 -0400

The problems are not necessarily caused by any specific spec on its
own. Many Web security issues occur because the components are
developed in isolation and people really don't have a good model for
how they behave as a group.

The IETF needs to be involved in this work. Quite how that happens is
another matter. One of the weaknesses of the IETF way of doing things
is that there is no clear mechanism for performing maintenance.

On Wed, Jul 14, 2010 at 11:33 AM, Cullen Jennings <[email-masked]> wrote:
> _______________________________________________
> Ietf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf
>

-- 
Website: http://hallambaker.com/