Subject: [Unbearable] HTTPSTB: use 'misuse' rather than 'theft' regarding theats to bound security tokens

From: [email-masked]
Date: Sun, 03 Jul 2016 20:04:35 -0600

https://github.com/TokenBinding/Internet-Drafts/issues/45

-tokbind-https aka HTTPSTB presently uses (in 3 places) the word  
"theft" in terms of the threats bound security tokens are protected  
from (by virtue of being bound to the client-server TLS layer).

In thinking about it, and as alluded to in [TBPROTO] section 8.1  
"security token replay", a bound security token is not protected from  
misappropriation (per se) by virtue of being bound. Rather, it is  
protected from being successfully misused by an attacker -- i.e., it  
will not be honored by the server (unless the attacker has infiltrated  
the user agent itself).

Thus I propose we use the term "misuse" rather than "theft" and alter  
surrounding text appropriately.

HTH,

=JeffH

---

From: Brian Campbell <[email-masked]>
Date: Tue, 5 Jul 2016 12:34:50 -0600

Makes sense to me.

On Sun, Jul 3, 2016 at 8:04 PM, <[email-masked]> wrote:

> -tokbind-https aka HTTPSTB presently uses (in 3 places) the word "theft"
> in terms of the threats bound security tokens are protected from (by virtue
> of being bound to the client-server TLS layer).
>
> In thinking about it, and as alluded to in [TBPROTO] section 8.1 "security
> token replay", a bound security token is not protected from
> misappropriation (per se) by virtue of being bound. Rather, it is protected
> from being successfully misused by an attacker -- i.e., it will not be
> honored by the server (unless the attacker has infiltrated the user agent
> itself).
>
> _______________________________________________
> Unbearable mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/unbearable
>