Subject: [http-auth] Stephen Farrell's Yes on draft-ietf-httpauth-basicauth-update-06: (with COMMENT)

From: "Stephen Farrell" <[email-masked]>
Date: Mon, 16 Feb 2015 17:52:02 -0800

Stephen Farrell has entered the following ballot position for
draft-ietf-httpauth-basicauth-update-06: Yes

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/draft-ietf-httpauth-basicauth-update/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

This is a pretty crappy auth scheme, but this is a pretty
good update and fills a need, thanks for the latter:-)

- section 2: is it worth saying somewhere that you can't
really have >1 proxy-auth happening even if you transit >1
proxy?

- section 2, last para: I assume this is because client
and/or server behaviour varies for this? If so, maybe it'd
be good to give some guidance or add a reference (if a
good one exists). If there's some other reason, it'd be
good to say too. 

- section 4: would it be worth adding some guidance that
re-use of e.g. entreprise login/SSO passwords for
proxy-auth is particularly dodgy as is not protected via
TLS?

---

From: Julian Reschke <[email-masked]>
Date: Tue, 17 Feb 2015 08:33:50 +0100

On 2015-02-17 02:52, Stephen Farrell wrote:
> ...

Thanks :-)

> really have >1 proxy-auth happening even if you transit >1

Somewhere yes, but not here. When we do RFC7235bis, I'd like to get the 
proxy auth parts some attention, and that needs feedback from people who 
actually do have some experience with it (which I do not).

> and/or server behaviour varies for this? If so, maybe it'd

Yes.

> good one exists). If there's some other reason, it'd be

I don't have a reference nor guidance. UAs behave differently and are 
allowed to do so. I don't think we can say something beyond that.

> proxy-auth is particularly dodgy as is not protected via

There's a lot of things that can be said about the topic of password 
choice and re-use. Is it specific to Basic auth? I'm not opposed to add 
something, but this sounds like an open-ended topic. If you have a 
concrete proposal for text, I'm all ears :-)

Best regards, Julian

---

From: Julian Reschke <[email-masked]>
Date: Tue, 17 Feb 2015 08:33:50 +0100

Thanks :-)

Yes.

Best regards, Julian