Subject: [Unbearable] Should we only send Token Binding Message when sending cookies?

From: Bill Cox <[email-masked]>
Date: Tue, 25 Aug 2015 06:54:08 -0700

Sorry for having missed the discussions so far.  This has probably already
been discussed to death...

I am worried there will be bugs, such as sending a Token Binding Message
header when cookies have been disabled by the user.  I've just started
reading about cookie policy, and so far, it seems insanely complex.  Some
browsers might block third party cookies, or cookies to particular third
party domains that are advertisers known to track users.  Should we send
our Token Binding ID in this case?

A simple way to insure we are not leaking user information might be to
check that the Token Binding Message is only sent if the cookie header is
present.  If the browser is blocking cookies for some reason, I suspect we
should also block Token Binding Messages.  Are there good use-cases for the
Token Binding Message when there is no cookie present?

As for HTTP2 compression, this would only result in increased traffic when
the cookie policy changes.  In general, if we do 50 requests to a web site,
we send the same cookies 50 times.  In that case, we'd also send the Token
Binding Message header 50 times.  Is it rare to change to sending cookies,
and then not, to the same domain.

I read that Yahoo and Google recommend having separate static content
domains so that when loading static content, the browser does not bother
sending any cookies.  This makes page loading faster.  In this case, we
could also slightly speed things up over HTTP by not sending any Token
Binding Message header.

What do you think?

Bill

---

From: John Bradley <[email-masked]>
Date: Tue, 25 Aug 2015 12:20:37 -0300

Token Binding may also be used to protect redirect based messages like OpenID Connect and SAML.  So while I would expect both a IdP and SP to be setting cookies under normal circumstances, not every token protected by token binding is a cookie.

Interesting observations though.

John B.

> On Aug 25, 2015, at 10:54 AM, Bill Cox <[email-masked]> wrote:
> 
> Sorry for having missed the discussions so far.  This has probably already been discussed to death...
> 
> I am worried there will be bugs, such as sending a Token Binding Message header when cookies have been disabled by the user.  I've just started reading about cookie policy, and so far, it seems insanely complex.  Some browsers might block third party cookies, or cookies to particular third party domains that are advertisers known to track users.  Should we send our Token Binding ID in this case?
> 
> A simple way to insure we are not leaking user information might be to check that the Token Binding Message is only sent if the cookie header is present.  If the browser is blocking cookies for some reason, I suspect we should also block Token Binding Messages.  Are there good use-cases for the Token Binding Message when there is no cookie present?
> 
> As for HTTP2 compression, this would only result in increased traffic when the cookie policy changes.  In general, if we do 50 requests to a web site, we send the same cookies 50 times.  In that case, we'd also send the Token Binding Message header 50 times.  Is it rare to change to sending cookies, and then not, to the same domain.
> 
> I read that Yahoo and Google recommend having separate static content domains so that when loading static content, the browser does not bother sending any cookies.  This makes page loading faster.  In this case, we could also slightly speed things up over HTTP by not sending any Token Binding Message header.
> 
> What do you think?
> 
> Bill
> _______________________________________________
> Unbearable mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/unbearable

---

From: Andrei Popov <[email-masked]>
Date: Tue, 25 Aug 2015 16:30:04 +0000

Token Binding messages are encapsulated in the application protocol and handled at the application protocol layer, therefore it seems feasible to only send them when needed.

There has been a separate discussion about removing the requirement that the Provided binding is sent in the very first application_data payload after TB has been negotiated.

Perhaps we can combine both ideas and say that the application MUST send Token Binding messages whenever it is requesting or supplying tokens?

Cheers,

Andrei

-----Original Message-----
From: Unbearable [mailto:[email-masked]] On Behalf Of John Bradley
Sent: Tuesday, August 25, 2015 8:21 AM
To: Bill Cox <[email-masked]>
Cc: [email-masked]
Subject: Re: [Unbearable] Should we only send Token Binding Message when sending cookies?

John B.

---

From: Bill Cox <[email-masked]>
Date: Tue, 25 Aug 2015 10:03:28 -0700

On Tue, Aug 25, 2015 at 9:30 AM, Andrei Popov <[email-masked]>
wrote:

> Token Binding messages are encapsulated in the application protocol and
> handled at the application protocol layer, therefore it seems feasible to
> only send them when needed.
>
> There has been a separate discussion about removing the requirement that
> the Provided binding is sent in the very first application_data payload
> after TB has been negotiated.
>
> Perhaps we can combine both ideas and say that the application MUST send
> Token Binding messages whenever it is requesting or supplying tokens?
>
> Cheers,
>
> Andrei
>
> That sounds good to me.

BIll

---

From: [email-masked]
Date: Tue, 25 Aug 2015 22:08:31 +0200

Hi Bill,

I dont know how to say this, so theres only one way - I have a basic gut aversion to the use of cookies in general in any security enhancing function. All of your concerns only express and enhance that.

On HTTP compression possibly speeding page loading, thats one of those theoretical novelties, affecting the real world like a drop in the ocean. Most of the pages I visist, particularly this last say 18 months or so, load slowly because of the adverts included, meaning the page cannot be scrolled until a flash finishes loading, a 2% speed up wont be noticed by most users.

Dean

Gesendet: Dienstag, 25. August 2015 um 15:54 Uhr

Von: "Bill Cox" <[email-masked]>

An: [email-masked]

Betreff: [Unbearable] Should we only send Token Binding Message when sending cookies?

What do you think?

Bill

_______________________________________________ Unbearable mailing list [email-masked] https://www.ietf.org/mailman/listinfo/unbearable