Subject: Re: [hybi] Masking debug capability proposition (WAS: Masking for WS data content)

From: Joel Martin <[email-masked]>
Date: Wed, 2 Mar 2011 17:58:46 +0300

2011/2/26 Silvio Ventres <[email-masked]>
>
> PROPOSITION:
>
> Is it possible to include a section specifically allowing WS applications
> to set
> some kind of "debug" flag to set XOR mask to 0?
>

It's a reasonable request but it would have to be a browser configuration
option (or UA) or at least always pop-up a security dialog, because allowing
it to be set from the Javascript would make the masking useless since
malicious Javascript is part of the threat model. As the most motivated
person on the list, you should propose it with browser vendors (and/or the
WebSockets API folks). Alternately you could code up a very simple WS proxy
that could be run on the same system as the UA/browser and that would strip
the masking and set the key to zeros before sending on to the real
destination.

Regards,

Joel Martin