Subject: Re: [http-auth] HTTP Auth Next BOF at IETF Prague deadline Monday/Possible W3C Workshop?

From: Yoav Nir <[email-masked]>
Date: Mon, 28 Feb 2011 11:03:46 +0200

On Jan 31, 2011, at 7:42 PM, Peter Saint-Andre wrote:
> 
> I think that a "bar bof" / informal side meeting at the Prague IETF
> meeting makes the most sense, followed by focused discussions on this
> list and then a WG-forming BoF at IETF 81 (if we think that's needed).
> 
> I say that because I don't think we're quite ready to form a working
> group, but we have important technical topics to discuss. We could hold
> a non-WG-forming BoF ("exploratory BoF") but an informal side meeting
> might be less pressured and therefore more productive -- in my
> experience it's best to hold a BoF when you have a strong proposal about
> forming a WG.

Hi.

I'm still making my travel plans, so has anyone thought of when to hold such a "bar bof" / side meeting ?  The "known bar bof" at the meeting main page is still not a link.

Thanks

Yoav

---

From: Yutaka OIWA <[email-masked]>
Date: Tue, 01 Mar 2011 10:06:25 +0900

Dear Yoav,

Now the draft WG timetable is available, and this time in Prague, there seems to
be a slightly different scheduling schema (e.g. a plenary in Monday, some
apparea efforts e.g. httpbis in Thursday).
For the first impression, IMO Tuesday or Thursday evening seems to be
a good place.
If no other opinions, we will check the timetable wholly and propose a candidate
in a few days.

In addition, comments for the discussion item list which I posted before are
really *needed* and will be greatly welcomed. >all

On 2011/02/28 18:03, Yoav Nir wrote:
> _______________________________________________
> http-auth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/http-auth

---

From: Yoav Nir <[email-masked]>
Date: Tue, 1 Mar 2011 09:06:05 +0200

> really *needed* and will be greatly welcomed. >all

I think everyone who has responded agrees that something should be done. Basic or digest auth, with the only alternative being a webform is not good enough.

Someone (I think it was Marsh Ray) think that doing proper authentication in HTTP doesn't do much unless you also use data authentication, such as in TLS. I tend to agree, since simple HTTP is vulnerable to a MitM attack. I don't know if this is the general feeling of the (not yet) group.

The question is whether it is worthwhile to propose an authentication mechanism for HTTP itself, or to move it to TLS. Moving it to TLS has the advantage of binding the authenticated identity to the key, and adding APIs for the HTTP application to get the authenticated identity is trivial - it is already done for user certificate authentication. I'm sure there will be others who disagree.

I have a draft for putting authentication in TLS ( http://tools.ietf.org/html/draft-nir-tls-eap ), but there are other ways as well.

I think we also need to discuss the UI issue. Signing in with a webform is equivalent (as far as security is concerned) with basic authentication, and yet you don't see any websites using basic authentication. Regardless of how secure and wonderful we can make the protocol, I'd like to hear from people who understand web design what would convince the web designers to use the new mechanism rather than web forms.

Yoav