Subject: Re: WG Review: Recharter of Hypertext Transfer Protocol Bis (httpbis)

From: Henrik Nordström <[email-masked]>
Date: Wed, 29 Feb 2012 20:55:24 +0100

lör 2012-02-25 klockan 14:13 +0000 skrev Stephen Farrell:

> I don't agree with you there - the perceived low probability that
> something will be deployed is a real disincentive here. We have had
> people wanting to do work on this and have been told there's no point
> because it won't get adopted.

I do not agree that getting new auth schemes deployed if they do make
sense is such big problem in the longer scope.

We have already had two new auth schemes deployed within HTTP/1.1 during
the lifetime of HTTP/1.1 and which is in wide scale use today across
numerous different implementations. And these doesn't even followin HTTP
semantics...

A beauty of HTTP auth model here is that it can downgrade nicely,
allowing old clients to continue working only not gaining the benefits
of the new auth model. But that obviously have security implications as
well if newer user-agents can be fooled into downgrading.

Regards
Henrik

---

From: Henrik Nordström <[email-masked]>
Date: Wed, 29 Feb 2012 20:57:31 +0100

lör 2012-02-25 klockan 17:44 +0000 skrev Stephen Farrell:

> I don't think fixing or changing the framework will give us better
> auth schemes by itself. (Better auth schemes may or may not require
> changes to the framework, I dunno.)

Obviously not. Fixing the framework giving better use of auth schemes
may triggering interest in finding a better auth scheme however.

Regards
Henrik

---

From: Henrik Nordström <[email-masked]>
Date: Wed, 29 Feb 2012 21:11:00 +0100

lör 2012-02-25 klockan 19:23 +0100 skrev Julian Reschke:
> Well, I'm one of the editors of the authentication framework spec, so if 
> there's something wrong with it, I'd like to know.

Only the thing said earluer

- Define how servers may influence the visible appearance of the login
action

- Perhaps some way of triggering a logout.

> So if we collectively think that the framework probably is ok, and that 
> we *do* need a new authentication scheme, what's stopping us to start 
> that activity *right now*?

Nothing.

A cleaned up http digest with less fancy bells no one implements
correctly and stronger methods would do nicely at improving the raw
security side of things.

But at the same time it alone does solve the reasons why HTTP Digest is
not widely used today which is or any of the newer use cases with auth
delegation via trusted third parties.

A very interesting thought is to look into how for example Kerberos
could be implemented as a first class HTTP Auth citizen without
violating HTTP messaging semantics. Is there anything needed at the
framework side for making that work right?

Regards
Henrik