Subject: Re: [apps-discuss] WebFinger should be HTTPS only

From: Salvatore Loreto <[email-masked]>
Date: Sun, 7 Oct 2012 20:59:28 +0300

On 9/25/12 8:41 AM, Paul E. Jones wrote:
> On 9/11/2012 1:43 PM, Mike Jones wrote:
>>
>> Having looked at the WebFinger specification a bit more, I recently 
>> realized that it currently does not require TLS to be used.  Section 
>> 5.1 - Performing a WebFinger Query – currently begins “The first step 
>> a client must perform in executing a WebFinger query is to query for 
>> the host metadata using HTTPS or HTTP”. This concerns me, since this 
>> may enable classes of phishing attacks in some situations.
>>
>> I would therefore request that the specification be updated to 
>> prohibit non-TLS connections.
>>
>> Thank you,
>>
>> -- Mike
>>
>
> Mike,
>
> The spec currently recommends the use of HTTPS, as did RFC 6415 
> (referenced right after the text you highlight).  I do not believe we 
> can mandate HTTPS.  There may be private networks that use WebFinger 
> that do not need HTTPS.  There will definitely be those who do not 
> want to pay for the certificate to protect WebFinger. We can strongly 
> recommend use of HTTPS, but I don't think we can mandate it.
>
> Paul
>
Hi there,

I tend to agree with with Paul and Evan, in the case TLS is required we 
have the text in RFC6415
Here's the language from RFC 6415:

    Applications utilizing the host-meta document where the authenticity
    of the information is necessary MUST require the use of the HTTPS
    protocol and MUST NOT produce a host-meta document using other means.

perhaps it would be a good idea to insert a similar text in WebFinger draft
to stress the point.

/Salvatore

-- 
Salvatore Loreto, PhD
www.sloreto.com