Subject: [xmpp] #37: text about trusting stream header attributes is misleading

From: "xmpp issue tracker" <[email-masked]>
Date: Tue, 15 Jun 2010 02:45:31 -0000

#37: text about trusting stream header attributes is misleading
--------------------------------+-------------------------------------------
 Reporter:  stpeter@…           |       Owner:  stpeter@…         
     Type:  defect              |      Status:  new               
 Priority:  minor               |   Milestone:                    
Component:  3920bis             |     Version:                    
 Severity:  In WG Last Call     |    Keywords:                    
--------------------------------+-------------------------------------------
 Section 4.4 states:

 > Security Note: Until and unless the confidentiality and integrity
 > of a stream header is ensured via Transport Layer Security as
 > described under Section 5, an entity SHOULD NOT trust the
 > attributes provided in a stream header.

 Waqas Hussain commented: "Assurance of confidentiality and integrity does
 not mean the data can be trusted. Trust must require authentication."

-- 
Ticket URL: <http://tools.ietf.org/wg/xmpp/trac/ticket/37>
xmpp <http://tools.ietf.org/xmpp/>

---

From: Peter Saint-Andre <[email-masked]>
Date: Mon, 14 Jun 2010 20:59:51 -0600

> #37: text about trusting stream header attributes is misleading

I suggest that we change the text to:

   Security Note: Until and unless the confidentiality and integrity
   of a stream header is ensured via Transport Layer Security as
   described under Section 5, the attributes provided in a stream
   header could be tampered with by an attacker.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: "xmpp issue tracker" <[email-masked]>
Date: Fri, 25 Jun 2010 04:13:11 -0000

#37: text about trusting stream header attributes is misleading
--------------------------------+-------------------------------------------
 Reporter:  stpeter@…           |        Owner:  stpeter@…         
     Type:  defect              |       Status:  closed            
 Priority:  minor               |    Milestone:                    
Component:  3920bis             |      Version:                    
 Severity:  In WG Last Call     |   Resolution:  fixed             
 Keywords:                      |  
--------------------------------+-------------------------------------------
Changes (by stpeter@…):

  * status:  new => closed
  * resolution:  => fixed

Comment:

 Provisionally resolved by changing text to:

-- 
Ticket URL: <http://trac.tools.ietf.org/wg/xmpp/trac/ticket/37#comment:1>
xmpp <http://tools.ietf.org/xmpp/>