Subject: Re: [apps-discuss] I'm calling this sans-tls bluff

From: Evan Prodromou <[email-masked]>
Date: Sat, 01 Dec 2012 10:48:11 -0500

On 12-11-29 05:03 PM, Breno de Medeiros wrote:
> On Thu, Nov 29, 2012 at 12:53 PM, Evan Prodromou <[email-masked]> wrote:
>> I disagree with the premise. I don't think it's impossible to use Webfinger
>> securely if it's possible to use Webfinger insecurely. Just say, "For this
>> application, only use HTTPS."
> You are free to disagree, but that doesn't change the facts. If the
> client will fallback to HTTP, the server can do nothing to protect
> that client. If by client you mean popular implementations in open
> source libraries, then the server cannot protect most users.
Then don't use those libraries for security-related applications.

--Evan

---

From: Melvin Carvalho <[email-masked]>
Date: Sat, 1 Dec 2012 17:03:17 +0100

On 29 November 2012 20:23, Joseph Holsten <[email-masked]> wrote:

> I don't think this wf-sans-tls issue is an issue to any real, existent
> person.
>
> I'll bet $50 that you can't find a site operator that has >50 users and
> would implement webfinger so long as it doesn't require https.
>

Is having >50 users a requirement for webfinger?

> --
> http://josephholsten.com

---

From: John Bradley <[email-masked]>
Date: Sat, 1 Dec 2012 14:34:26 -0300

Saying we want WF servers to be static resources and serve up two different versions of the document depending on if it is https: or not is possible but a likely interoperability nightmare.

That leaves it up to each WF publisher to decide where each link relation can go.  

I prefer all TLS or no TLS at least that is clear to everyone what to expect.

John B.

On 2012-11-30, at 4:12 PM, Paul Hoffman <[email-masked]> wrote:

> On Nov 30, 2012, at 10:49 AM, Nico Williams <[email-masked]> wrote:
> 
>> Er, why not:
>> 
>> - if you use TLS you can get the whole resource
>> - if you don't use TLS you get a reduced resource (e.g., minus any
>> security-relevant content)
>> 
>> Or, alternatively, and better, if the client didn't use TLS, then the
>> client MUST NOT trust any security-relevant content, and the client
>> really must not trust any of the content.  Lack of trust != useless.
>> The old finger protocol was never secure, yet it was useful....
> 
> +1
> 
> _______________________________________________
> apps-discuss mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/apps-discuss