Subject: Re: Straw-man charter for http-bis

From: Robert Sayre <[email-masked]>
Date: Tue, 19 Jun 2007 01:14:56 +0000

Henrik Nordstrom wrote:
> Yes, and is what has been proposed several times, in several threads on
> the topic.. but no detailed proposal written down yet.
>
> I would very much welcome a proposal from some browser vendor on this.
> It's mainly browser technology which needs updates to adopt a feature
> like this, on the server side it's most often just reconfiguration or at
> worst trivial changes depending on the fine details of the proposed
> extension and nature of the server implementation of 401 responses.

I don't think it's worth implementing something like that for Basic or 
Digest, given the known weaknesses they have. To make this effective, 
the UI will still need to be "chrome" (trusted UI from the browser), but 
allow some presentation control as well. Personally, I'm not comfortable 
giving users security cues of that sort with the existing schemes, so I 
think an authentication scheme that satisfies most of the requirements 
in the Hartman draft is a prerequisite.

The technical details of the 401 response won't be too difficult, but 
figuring out the right level of presentation control for site authors 
will probably require a good deal of research and experimentation.

- Rob

---

From: Julian Reschke <[email-masked]>
Date: Tue, 19 Jun 2007 10:40:48 +0200

> will probably require a good deal of research and experimentation.

I do agree with the latter, and therefore I disagree with you said before.

Trying to do everything at the same time may lead that nothing at all is 
done in the end. Thus starting the experiments around enhancing browser 
with respect to 401 and login forms should start as soon as possible.

Best regards, Julian

---

From: Henrik Nordstrom <[email-masked]>
Date: Tue, 19 Jun 2007 15:42:25 +0200

> in the Hartman draft is a prerequisite.

Kerberos Negotiate also has the same presentation problem.

It's a generic UI problem quite independent from the actual
authentication scheme, but needing to support multiple schemes. And as
you say figuring out the right level of control requires a bit of
research.

If this is not started until there is a strong authentication scheme
available it will take even longer, and additionally considerably less
people will be interested in seeing the task of finding a better
authentication scheme to move forward.

The current set of at least 4 schemes (Basic, Digest, NTLM, Negotiate)
is more than sufficient as a test bed to figure out the correct UI
requirements, including the ability to inform the user about the
technical strength of each.. so even without a stronger authentication
scheme being available right now there is a lot to benefit.

Regards
Henrik

---

From: Robert Sayre <[email-masked]>
Date: Tue, 19 Jun 2007 19:18:05 +0000

Julian Reschke wrote:
> Trying to do everything at the same time may lead that nothing at all 
> is done in the end. Thus starting the experiments around enhancing 
> browser with respect to 401 and login forms should start as soon as 
> possible.

In otherwords, start work on UI for a feature that has never been 
successfully delivered, faces many non-technical obstacles to adoption, 
and is to be specified by an unchartered 2617bis WG or a 2616bis WG with 
an inadequate charter? Sorry, that is not a good use of time, as things 
stand.

- Rob