Subject: [http-auth] I-D Action: draft-ietf-httpauth-basicauth-update-00.txt

From: [email-masked]
Date: Fri, 13 Sep 2013 07:03:29 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Hypertext Transfer Protocol Authentication Working Group of the IETF.

	Title           : The 'Basic' HTTP Authentication Scheme
	Author(s)       : Julian F. Reschke
	Filename        : draft-ietf-httpauth-basicauth-update-00.txt
	Pages           : 8
	Date            : 2013-09-13

Abstract:
   This document defines the "Basic" Hypertext Transfer Protocol (HTTP)
   Authentication Scheme.

Editorial Note (To be removed by RFC Editor before publication)

   Discussion of this draft takes place on the HTTPAuth working group
   mailing list ([email-masked]), which is archived at <http://
   www.ietf.org/mail-archive/web/http-auth/current/maillist.html>.

   XML versions, latest edits and the issues list for this document are
   available from <http://greenbytes.de/tech/
   webdav/#draft-ietf-httpauth-basicauth-update>.

   The changes in this draft are summarized in Appendix A.1.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-httpauth-basicauth-update

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-httpauth-basicauth-update-00

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Yoav Nir <[email-masked]>
Date: Fri, 13 Sep 2013 14:17:08 +0000

Thanks, Julian.

This draft covers Basic Authentication and is planned to obsolete that part of RFC 2617.

However, I think the content should be merged with the encoding update. 

Yoav

On Sep 13, 2013, at 5:03 PM, [email-masked] wrote:

> _______________________________________________
> http-auth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/http-auth

---

From: Julian Reschke <[email-masked]>
Date: Fri, 13 Sep 2013 16:18:25 +0200

On 2013-09-13 16:17, Yoav Nir wrote:
> ....

Understood & agreed. I just want to get the "other" parts right first.

Best regards, Julian

---

From: Bjoern Hoehrmann <[email-masked]>
Date: Fri, 13 Sep 2013 19:45:47 +0200

>http://tools.ietf.org/html/draft-ietf-httpauth-basicauth-update-00

The abstract could use another sentence stating what the `Basic` scheme
is.

Later on, "Upon receipt of an unauthorized request ..." should be re-
worded, right now it sounds like a breach of protocol, that you are
supposed to obtain authorisation prior to making the request; but that
is not the case.

In section 3, "within a base64 [RFC2396] encoded string" the reference
is wrong (RFC 2396 is URI syntax).

Also in section 3, "Userids might be case sensitive." would be better
as something like "The userid value ..." and it should probably clarify
that servers may choose to treat it case-insensitively (and clients
ought to pass it on as entered by the user, I suppose).

I've checked the Aladdin example's base64 encoded header value and it
seems to be correct (good).

In section 4 "HTTP does not prevent the addition of enhancements (such
as schemes to use one-time passwords) to Basic authentication." seems
confusingly worded. I would go more in a direction like "Operational
policies like one-time passwords can enhance ..." or something like it.

In "Because Basic authentication involves the cleartext transmission of
passwords it SHOULD NOT be used (without enhancements) to protect
sensitive or valuable information." there should probably a reference to
securing the communication channel end-to-end; right now it reads like
something like the mentioned one-time passwords is neccessary/sufficient
which is probably not the idea.
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

---

From: Julian Reschke <[email-masked]>
Date: Sat, 14 Sep 2013 17:40:22 +0200

> ought to pass it on as entered by the user, I suppose).

Yes. See 
<http://trac.tools.ietf.org/html/draft-ietf-httpauth-basicauth-update-00#appendix-B.2>.

> policies like one-time passwords can enhance ..." or something like it.

Maybe.

> which is probably not the idea.

Citing Section 1:

    This document defines the "Basic" Hypertext Transfer Protocol (HTTP)
    Authentication Scheme ([draft-ietf-httpbis-p7-auth]).  This scheme is
    not considered to be a secure method of user authentication unless
    used in conjunction with some external secure system such as TLS
    (Transport Layer Security, [RFC5246]), as the user name and password
    are passed over the network as cleartext.

Best regards, Julian