From dev.akhawe@gmail.com Fri Aug 6 11:36:05 2010 Return-Path: X-Original-To: hasmat@core3.amsl.com Delivered-To: hasmat@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 30F603A68D0 for ; Fri, 6 Aug 2010 11:36:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.001, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id u6Ssp6xEjzvt for ; Fri, 6 Aug 2010 11:36:04 -0700 (PDT) Received: from mail-qy0-f179.google.com (mail-qy0-f179.google.com [209.85.216.179]) by core3.amsl.com (Postfix) with ESMTP id 3B6FF3A6898 for ; Fri, 6 Aug 2010 11:36:01 -0700 (PDT) Received: by qyk8 with SMTP id 8so6336115qyk.10 for ; Fri, 06 Aug 2010 11:36:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:mime-version:received:from:date :message-id:subject:to:content-type; bh=2befMqOGvPXDoR6cfHMXaQWEmS5gXV1VzilrnlOs+fE=; b=C7C2afNDYhw+51ROnnMKa1qVTf5s+swL6/fBNcjS+ZGJ4AI2wKJZKZIZT7kcVgMgA2 8KQ81dsi+ACjfGwTyncIfcwV6WapmLn9tQ+c/P94Skh6Ft/cIColUlU0eVYkKu+JUK92 aCNFY1NTncQUdh/D+vPDxNtnV65gwbPXT0CwI= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:from:date:message-id:subject:to:content-type; b=YxbezywjLfcLj+/V8p2g/R9FjTGdMd/dUbQgoTaad4aRtxOMSdtGOpdYRVLeeWxoOR n7v5hO/k9gk3/Epl69WmyvJATyT3ypqtUzrqi1zZohcBCBOi95TB3mrWSoyra3bZQZPk M79Brb/IvvXLx5McVdV3mV57JlxfmWhBMLH2c= Received: by 10.224.79.40 with SMTP id n40mr69815qak.306.1281119792154; Fri, 06 Aug 2010 11:36:32 -0700 (PDT) MIME-Version: 1.0 Received: by 10.229.2.19 with HTTP; Fri, 6 Aug 2010 11:36:12 -0700 (PDT) From: Devdatta Akhawe Date: Fri, 6 Aug 2010 11:36:12 -0700 Message-ID: To: IETF HASMAT list Content-Type: text/plain; charset=ISO-8859-1 Subject: [HASMAT] HSTS Threat prevalence X-BeenThere: hasmat@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: HTTP Application Security Minus Authentication and Transport List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Aug 2010 18:36:05 -0000 Hi all The HSTS specification talks about possible attacks that could be prevented by the use of HSTS. Do we have any data that suggests these attacks are actually a concern / being used by attackers anywhere ? I couldn't find any citation to this effect in the specification. thanks regards devdatta From dev.akhawe@gmail.com Fri Aug 6 12:09:11 2010 Return-Path: X-Original-To: hasmat@core3.amsl.com Delivered-To: hasmat@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 127A53A6A2F for ; Fri, 6 Aug 2010 12:09:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MpBUlUOizO8B for ; Fri, 6 Aug 2010 12:09:10 -0700 (PDT) Received: from mail-qw0-f44.google.com (mail-qw0-f44.google.com [209.85.216.44]) by core3.amsl.com (Postfix) with ESMTP id 0EAA13A68CC for ; Fri, 6 Aug 2010 12:09:09 -0700 (PDT) Received: by qwe5 with SMTP id 5so5736995qwe.31 for ; Fri, 06 Aug 2010 12:09:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:mime-version:received:in-reply-to :references:from:date:message-id:subject:to:cc:content-type :content-transfer-encoding; bh=CzwteqiiiQMtC+2Yq2I18xeXq923s5am1p6xvMGRBLM=; b=WGDBC2SSHkNiFf03JrSa/78ut+ayoTt3xTBFw6QXaCUFSjP+ZKqdrdc0vGG2zoBsdI kXK0tYWevu0lgqzba33zbifNVF2uC7SoaTO8SmhxEJS2ibmjNIORBrT0SCWjyb3wXB6L jpYTPIy+ihvaBgrMU3Cq2P2cKqTYQP4vllXaE= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type:content-transfer-encoding; b=nYKv1d/I9JucbrNFsoyqvK6AlmFPekyyabYZiZTJrOwQ7J3yryIdpGFCEbPk71ydYt WiU3jtcOOwON4+JJvHTPGpsaljrpk98kUPWYI2njf1Dh6raaB4SYncm01mMpMQtfNbve vSwYXG3ZA9+AljFHTdHRFd1ZUiE09qdA/+t/U= Received: by 10.224.96.146 with SMTP id h18mr6408336qan.156.1281121781160; Fri, 06 Aug 2010 12:09:41 -0700 (PDT) MIME-Version: 1.0 Received: by 10.229.2.19 with HTTP; Fri, 6 Aug 2010 12:09:21 -0700 (PDT) In-Reply-To: <5EE049BA3C6538409BBE6F1760F328ABEAD832B390@DEN-MEXMS-001.corp.ebay.com> References: <5EE049BA3C6538409BBE6F1760F328ABEAD832B390@DEN-MEXMS-001.corp.ebay.com> From: Devdatta Akhawe Date: Fri, 6 Aug 2010 12:09:21 -0700 Message-ID: To: "Steingruebl, Andy" Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Cc: IETF HASMAT list Subject: Re: [HASMAT] HSTS Threat prevalence X-BeenThere: hasmat@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: HTTP Application Security Minus Authentication and Transport List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Aug 2010 19:09:11 -0000 #1 would be good - for a reasonably representative sample (i.e. no stories ' I once sat in a cafe and ... '). cheers devdatta On 6 August 2010 11:52, Steingruebl, Andy wro= te: >> -----Original Message----- >> From: hasmat-bounces@ietf.org [mailto:hasmat-bounces@ietf.org] On >> Behalf Of Devdatta Akhawe >> Sent: Friday, August 06, 2010 11:36 AM >> To: IETF HASMAT list >> Subject: [HASMAT] HSTS Threat prevalence >> >> Hi all >> >> The HSTS specification talks about possible attacks that could be preven= ted >> by the use of HSTS. Do we have any data that suggests these attacks are >> actually a concern / being used by attackers anywhere ? I couldn't find = any >> citation to this effect in the specification. > > We are actively doing research in this area, but we don't know of any pub= lished work at this point. > > For the wider audience - do you want to know: > 1. Whether this is occurring > 2. Its overall frequency/distribution > 3. Both > > Which of these would be most compelling? =A0On a percentage basis the num= ber of connections being observed by passive network attackers is probably = very small. =A0That doesn't by itself mean to should get rid of TLS. > > Me - I initially want the answer to #1, and then to #2. > > - Andy > From marsh@extendedsubset.com Fri Aug 6 12:16:18 2010 Return-Path: X-Original-To: hasmat@core3.amsl.com Delivered-To: hasmat@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 85A873A6A6B for ; Fri, 6 Aug 2010 12:16:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.981 X-Spam-Level: X-Spam-Status: No, score=-1.981 tagged_above=-999 required=5 tests=[AWL=0.618, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 93RsfhDcHR5B for ; Fri, 6 Aug 2010 12:16:17 -0700 (PDT) Received: from mho-02-ewr.mailhop.org (mho-02-ewr.mailhop.org [204.13.248.72]) by core3.amsl.com (Postfix) with ESMTP id 9533C3A6878 for ; Fri, 6 Aug 2010 12:16:17 -0700 (PDT) Received: from xs01.extendedsubset.com ([69.164.193.58]) by mho-02-ewr.mailhop.org with esmtpa (Exim 4.68) (envelope-from ) id 1OhSPR-000OS8-0V; Fri, 06 Aug 2010 19:16:49 +0000 Received: from [192.168.1.15] (localhost [127.0.0.1]) by xs01.extendedsubset.com (Postfix) with ESMTP id 33372604B; Fri, 6 Aug 2010 19:16:47 +0000 (UTC) X-Mail-Handler: MailHop Outbound by DynDNS X-Originating-IP: 69.164.193.58 X-Report-Abuse-To: abuse@dyndns.com (see http://www.dyndns.com/services/mailhop/outbound_abuse.html for abuse reporting information) X-MHO-User: U2FsdGVkX1+0gMymr72K55YavUiLpE08AECDpXT3moQ= Message-ID: <4C5C5F9D.3050107@extendedsubset.com> Date: Fri, 06 Aug 2010 14:16:45 -0500 From: Marsh Ray User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.11) Gecko/20100713 Thunderbird/3.0.6 MIME-Version: 1.0 To: Devdatta Akhawe References: <5EE049BA3C6538409BBE6F1760F328ABEAD832B390@DEN-MEXMS-001.corp.ebay.com> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: "Steingruebl, Andy" , IETF HASMAT list Subject: Re: [HASMAT] HSTS Threat prevalence X-BeenThere: hasmat@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: HTTP Application Security Minus Authentication and Transport List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Aug 2010 19:16:18 -0000 On 08/06/2010 02:09 PM, Devdatta Akhawe wrote: > #1 would be good - for a reasonably representative sample (i.e. no > stories ' I once sat in a cafe and ... '). How about "I've sat in cafes on multiple occasions with professional pen-testers who told me that they employ these techniques quite effectively on a regular basis"? - Marsh > On 6 August 2010 11:52, Steingruebl, Andy wrote: >>> -----Original Message----- >>> From: hasmat-bounces@ietf.org [mailto:hasmat-bounces@ietf.org] On >>> Behalf Of Devdatta Akhawe >>> Sent: Friday, August 06, 2010 11:36 AM >>> To: IETF HASMAT list >>> Subject: [HASMAT] HSTS Threat prevalence >>> >>> Hi all >>> >>> The HSTS specification talks about possible attacks that could be prevented >>> by the use of HSTS. Do we have any data that suggests these attacks are >>> actually a concern / being used by attackers anywhere ? I couldn't find any >>> citation to this effect in the specification. >> >> We are actively doing research in this area, but we don't know of any published work at this point. >> >> For the wider audience - do you want to know: >> 1. Whether this is occurring >> 2. Its overall frequency/distribution >> 3. Both >> >> Which of these would be most compelling? On a percentage basis the number of connections being observed by passive network attackers is probably very small. That doesn't by itself mean to should get rid of TLS. >> >> Me - I initially want the answer to #1, and then to #2. >> >> - Andy >> > _______________________________________________ > HASMAT mailing list > HASMAT@ietf.org > https://www.ietf.org/mailman/listinfo/hasmat From dev.akhawe@gmail.com Fri Aug 6 15:07:53 2010 Return-Path: X-Original-To: hasmat@core3.amsl.com Delivered-To: hasmat@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 81BB13A687D for ; Fri, 6 Aug 2010 15:07:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id akStf0LpWdgC for ; Fri, 6 Aug 2010 15:07:52 -0700 (PDT) Received: from mail-qy0-f179.google.com (mail-qy0-f179.google.com [209.85.216.179]) by core3.amsl.com (Postfix) with ESMTP id 68A113A687C for ; Fri, 6 Aug 2010 15:07:52 -0700 (PDT) Received: by qyk8 with SMTP id 8so6492761qyk.10 for ; Fri, 06 Aug 2010 15:08:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:mime-version:received:in-reply-to :references:from:date:message-id:subject:to:cc:content-type :content-transfer-encoding; bh=owCnkKIC53OZvNEgSTSppV4NV4yWdHHC3DNnQBnBqYE=; b=Qx1B0C1uDizcWt5lDlP6qHQuHructyL3mNx6zQlFV/baNjk/EC8PtEpyX8jXzoWqoE BjFJC68zBY0fTwVEuMChlkthaZP4/L+BaLjFHnOpTaNQBVtCCQ85PqLpB/xwR32Gf43t MiB7S51eyvBocGkr6YO4JJ7BtzCD4ejHPJa7Y= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type:content-transfer-encoding; b=aKkxCL71hegLMZqRvJx2yi1AT37KjtLu/YfFhR7mvM3qRJibsEjQcwz6lKU3kJAo2b vixeXyqqx4KynTFjczuD2Qm3TO6cnmmCyPytFsX0HjZfMndbSjuQqpBBuiCAVVVzD7lv JVCzRlERkb8sdbeMtqz17iPik2Y6PX3XmisJk= Received: by 10.224.80.203 with SMTP id u11mr6423795qak.127.1281132503249; Fri, 06 Aug 2010 15:08:23 -0700 (PDT) MIME-Version: 1.0 Received: by 10.229.2.19 with HTTP; Fri, 6 Aug 2010 15:08:03 -0700 (PDT) In-Reply-To: <4C5C5F9D.3050107@extendedsubset.com> References: <5EE049BA3C6538409BBE6F1760F328ABEAD832B390@DEN-MEXMS-001.corp.ebay.com> <4C5C5F9D.3050107@extendedsubset.com> From: Devdatta Akhawe Date: Fri, 6 Aug 2010 15:08:03 -0700 Message-ID: To: Marsh Ray Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Cc: "Steingruebl, Andy" , IETF HASMAT list Subject: Re: [HASMAT] HSTS Threat prevalence X-BeenThere: hasmat@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: HTTP Application Security Minus Authentication and Transport List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Aug 2010 22:07:53 -0000 >> >> #1 would be good - for a reasonably representative sample (i.e. no >> stories ' I once sat in a cafe and ... '). > > How about "I've sat in cafes on multiple occasions with professional > pen-testers who told me that they employ these techniques quite effective= ly > on a regular basis"? I am not sure if people targeted by professional pentesters are a "representative sample" of the general web user populace. Maybe I have a very optimistic/naive view of things. cheers devdatta > > - Marsh > > >> On 6 August 2010 11:52, Steingruebl, Andy >> =A0wrote: >>>> >>>> -----Original Message----- >>>> From: hasmat-bounces@ietf.org [mailto:hasmat-bounces@ietf.org] On >>>> Behalf Of Devdatta Akhawe >>>> Sent: Friday, August 06, 2010 11:36 AM >>>> To: IETF HASMAT list >>>> Subject: [HASMAT] HSTS Threat prevalence >>>> >>>> Hi all >>>> >>>> The HSTS specification talks about possible attacks that could be >>>> prevented >>>> by the use of HSTS. Do we have any data that suggests these attacks ar= e >>>> actually a concern / being used by attackers anywhere ? I couldn't fin= d >>>> any >>>> citation to this effect in the specification. >>> >>> We are actively doing research in this area, but we don't know of any >>> published work at this point. >>> >>> For the wider audience - do you want to know: >>> 1. Whether this is occurring >>> 2. Its overall frequency/distribution >>> 3. Both >>> >>> Which of these would be most compelling? =A0On a percentage basis the >>> number of connections being observed by passive network attackers is >>> probably very small. =A0That doesn't by itself mean to should get rid o= f TLS. >>> >>> Me - I initially want the answer to #1, and then to #2. >>> >>> - Andy >>> >> _______________________________________________ >> HASMAT mailing list >> HASMAT@ietf.org >> https://www.ietf.org/mailman/listinfo/hasmat > > From dev.akhawe@gmail.com Fri Aug 6 15:26:52 2010 Return-Path: X-Original-To: hasmat@core3.amsl.com Delivered-To: hasmat@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8E48F28C0E7 for ; Fri, 6 Aug 2010 15:26:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EYsfB72eKOcU for ; Fri, 6 Aug 2010 15:26:51 -0700 (PDT) Received: from mail-qw0-f44.google.com (mail-qw0-f44.google.com [209.85.216.44]) by core3.amsl.com (Postfix) with ESMTP id 913DE3A6948 for ; Fri, 6 Aug 2010 15:26:51 -0700 (PDT) Received: by qwe5 with SMTP id 5so5883811qwe.31 for ; Fri, 06 Aug 2010 15:27:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:mime-version:received:in-reply-to :references:from:date:message-id:subject:to:cc:content-type :content-transfer-encoding; bh=oft7wj2wJSZp5vd/AyFb9WzJXjVUvgjXRKcXnvhOFLc=; b=n9Ovf9nSiZpan5PEpYmI9UBaiSLEUdFzxkxKljvC4gbzUBBrydwcAYdOBF5lsiJ3q8 MsOE0007Zn1AdA2vw7zbZkO2Lf3wYAhtd+jP8xqfFOPhh/MOoMJiMgcoQH0Ab4+D0T84 2fYJtseBvcprArEZ7ppXN01d/L5Cc5b9y+emM= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type:content-transfer-encoding; b=KAjRYsoDn0ai2UqJ6dRTrusO+DBjH9sg/t82dzWI+hQaEI8CLu3+vTcc12UsanleX1 Q0eaFhmTOYsUQaxdvTAdcxJWvOCHU3H8LeKBLpY1e0kHMTxg5apTkNGzrZrPcyuPPTaT 6ryWOKuS6ifR5sv2kzsEOYN980Ivh8RleKyks= Received: by 10.229.203.161 with SMTP id fi33mr5204875qcb.182.1281133643178; Fri, 06 Aug 2010 15:27:23 -0700 (PDT) MIME-Version: 1.0 Received: by 10.229.2.19 with HTTP; Fri, 6 Aug 2010 15:27:03 -0700 (PDT) In-Reply-To: <5EE049BA3C6538409BBE6F1760F328ABEAD832B53F@DEN-MEXMS-001.corp.ebay.com> References: <5EE049BA3C6538409BBE6F1760F328ABEAD832B390@DEN-MEXMS-001.corp.ebay.com> <4C5C5F9D.3050107@extendedsubset.com> <5EE049BA3C6538409BBE6F1760F328ABEAD832B53F@DEN-MEXMS-001.corp.ebay.com> From: Devdatta Akhawe Date: Fri, 6 Aug 2010 15:27:03 -0700 Message-ID: To: "Steingruebl, Andy" Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Cc: IETF HASMAT list Subject: Re: [HASMAT] HSTS Threat prevalence X-BeenThere: hasmat@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: HTTP Application Security Minus Authentication and Transport List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Aug 2010 22:26:52 -0000 > One easy approach we considered was thinking of likely places for these t= ypes of attacks, and seeing if w can detect them. One easy example is airp= orts. Look for wifi in an airport and you'll usually see quite a number of = "free wifi" SSIDs, all with slightly carrying names. Who knows which one i= s the real one. I'd like to do a little experimenting on how many of those= are rogue. > I would add 'and are trying to do things which STS would have prevented' -devdatta On 6 August 2010 15:23, Steingruebl, Andy wro= te: >> -----Original Message----- >> From: Devdatta Akhawe [mailto:dev.akhawe@gmail.com] >> Sent: Friday, August 06, 2010 3:08 PM >> To: Marsh Ray >> Cc: Steingruebl, Andy; IETF HASMAT list >> Subject: Re: [HASMAT] HSTS Threat prevalence >> >> >> >> >> #1 would be good - for a reasonably representative sample (i.e. no >> >> stories ' I once sat in a cafe and ... '). >> > >> > How about "I've sat in cafes on multiple occasions with professional >> > pen-testers who told me that they employ these techniques quite >> > effectively on a regular basis"? >> >> I am not sure if people targeted by professional pentesters are a >> "representative sample" of the general web user populace. > > One easy approach we considered was thinking of likely places for these t= ypes of attacks, and seeing if w can detect them. =A0One easy example is ai= rports. Look for wifi in an airport and you'll usually see quite a number o= f "free wifi" SSIDs, all with slightly carrying names. =A0Who knows which o= ne is the real one. =A0I'd like to do a little experimenting on how many of= those are rogue. > > - Andy > From asteingruebl@paypal-inc.com Fri Aug 6 15:29:17 2010 Return-Path: X-Original-To: hasmat@core3.amsl.com Delivered-To: hasmat@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1BC703A69B3 for ; Fri, 6 Aug 2010 15:29:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.836 X-Spam-Level: X-Spam-Status: No, score=-4.836 tagged_above=-999 required=5 tests=[AWL=0.281, BAYES_00=-2.599, DNS_FROM_RFC_BOGUSMX=1.482, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ncy3hiq80ih4 for ; Fri, 6 Aug 2010 15:29:15 -0700 (PDT) Received: from den-mipot-002.corp.ebay.com (den-mipot-002.corp.ebay.com [216.113.175.153]) by core3.amsl.com (Postfix) with ESMTP id 9F7883A6948 for ; Fri, 6 Aug 2010 15:29:15 -0700 (PDT) DomainKey-Signature: s=ppinc; d=paypal-inc.com; c=nofws; q=dns; h=X-EBay-Corp:X-IronPort-AV:Received:Received:From:To:CC: Date:Subject:Thread-Topic:Thread-Index:Message-ID: References:In-Reply-To:Accept-Language:Content-Language: X-MS-Has-Attach:X-MS-TNEF-Correlator:acceptlanguage: Content-Type:Content-Transfer-Encoding:MIME-Version: X-CFilter; b=SMzN7ly2LYXWHv98eQmptf1qowZNS2D81Ixh+T+f2zcmRf/zYM7gCvUI Pn3fQ1i2+sjfJIsUG0Hu6vURxJwKMha2L+god1zUetxaAv3TbJMVeY601 ABhCj210Y/unmD8; DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=paypal-inc.com; i=asteingruebl@paypal-inc.com; q=dns/txt; s=ppinc; t=1281133787; x=1312669787; h=from:to:cc:date:subject:message-id:references: in-reply-to:content-transfer-encoding:mime-version; z=From:=20"Steingruebl,=20Andy"=20|To:=20Devdatta=20Akhawe=20 |CC:=20Marsh=20Ray=20,=20IETF =20HASMAT=20list=20|Date:=20Fri,=206=20A ug=202010=2016:29:45=20-0600|Subject:=20RE:=20[HASMAT]=20 HSTS=20Threat=20prevalence|Message-ID:=20<5EE049BA3C65384 09BBE6F1760F328ABEAD832B54C@DEN-MEXMS-001.corp.ebay.com> |References:=20=0D=0A=20=09<5EE049BA3C6538409BBE6F 1760F328ABEAD832B390@DEN-MEXMS-001.corp.ebay.com>=0D=0A =20=09=0D=0A=20=09<4C5C5F9D.3050107@extendedsubset .com>=0D=0A=20=0D=0A=20=09<5EE049BA3C6538409BBE6F176 0F328ABEAD832B53F@DEN-MEXMS-001.corp.ebay.com>=0D=0A=20|In-Reply-To:=20|Content-Transfer-Encoding: =20quoted-printable|MIME-Version:=201.0; bh=qgj4VWGJIoXUOTFcz7Cn/m32pGlp/iNB92/MZwvmbW8=; b=xZMfzIgmQeyLSPHepLY1t/h1DMxPOPTjBN/ENaBmMNKk3XS3W0d3rjM5 jF3CuQP3cCvcEwGlzSArh3dKlXZ4EOgx/pFd/nu/eCR8QJ7kyCDeIOTkR LUCuyfbVlNa4d+S; X-EBay-Corp: Yes X-IronPort-AV: E=Sophos;i="4.55,331,1278313200"; d="scan'208";a="71730455" Received: from den-vtenf-002.corp.ebay.com (HELO DEN-MEXHT-001.corp.ebay.com) ([10.101.112.213]) by den-mipot-002.corp.ebay.com with ESMTP; 06 Aug 2010 15:29:47 -0700 Received: from DEN-MEXMS-001.corp.ebay.com ([192.101.150.21]) by DEN-MEXHT-001.corp.ebay.com ([10.241.17.52]) with mapi; Fri, 6 Aug 2010 16:29:46 -0600 From: "Steingruebl, Andy" To: Devdatta Akhawe Date: Fri, 6 Aug 2010 16:29:45 -0600 Thread-Topic: [HASMAT] HSTS Threat prevalence Thread-Index: Acs1tpQYZ3gnXmz6SSiIBrbUafzibgAAD+Qw Message-ID: <5EE049BA3C6538409BBE6F1760F328ABEAD832B54C@DEN-MEXMS-001.corp.ebay.com> References: <5EE049BA3C6538409BBE6F1760F328ABEAD832B390@DEN-MEXMS-001.corp.ebay.com> <4C5C5F9D.3050107@extendedsubset.com> <5EE049BA3C6538409BBE6F1760F328ABEAD832B53F@DEN-MEXMS-001.corp.ebay.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CFilter: Scanned Cc: IETF HASMAT list Subject: Re: [HASMAT] HSTS Threat prevalence X-BeenThere: hasmat@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: HTTP Application Security Minus Authentication and Transport List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Aug 2010 22:29:17 -0000 > -----Original Message----- > From: Devdatta Akhawe [mailto:dev.akhawe@gmail.com] > Sent: Friday, August 06, 2010 3:27 PM > To: Steingruebl, Andy > Cc: Marsh Ray; IETF HASMAT list > Subject: Re: [HASMAT] HSTS Threat prevalence >=20 > > One easy approach we considered was thinking of likely places for these > types of attacks, and seeing if w can detect them. One easy example is > airports. Look for wifi in an airport and you'll usually see quite a numb= er of > "free wifi" SSIDs, all with slightly carrying names. Who knows which one= is > the real one. I'd like to do a little experimenting on how many of those= are > rogue. > > >=20 > I would add 'and are trying to do things which STS would have prevented' Sorry, that was what I meant in this case by "rogue". From asteingruebl@paypal-inc.com Fri Aug 6 11:51:51 2010 Return-Path: X-Original-To: hasmat@core3.amsl.com Delivered-To: hasmat@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 818CD3A6823 for ; Fri, 6 Aug 2010 11:51:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.117 X-Spam-Level: X-Spam-Status: No, score=-5.117 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, DNS_FROM_RFC_BOGUSMX=1.482, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yDaIfQyhnM4q for ; Fri, 6 Aug 2010 11:51:50 -0700 (PDT) Received: from den-mipot-001.corp.ebay.com (den-mipot-001.corp.ebay.com [216.113.175.152]) by core3.amsl.com (Postfix) with ESMTP id 834F03A67B2 for ; Fri, 6 Aug 2010 11:51:50 -0700 (PDT) DomainKey-Signature: s=ppinc; d=paypal-inc.com; c=nofws; q=dns; h=X-EBay-Corp:X-IronPort-AV:Received:Received:From:To:Date: Subject:Thread-Topic:Thread-Index:Message-ID:References: In-Reply-To:Accept-Language:Content-Language: X-MS-Has-Attach:X-MS-TNEF-Correlator:acceptlanguage: Content-Type:Content-Transfer-Encoding:MIME-Version: X-CFilter; b=XmlULYgqXynW5Hm5MYveGlwJ7j5+cgXvgzbi0b2rLRSzeoHO5tBQbLIT AJvK//BWWiZ1Zeh+9zqkAZ2N8L9K6Y0NwyfPH3ZQgYTVlMVJKbGmVTgk0 +lv4/shPiKCElgF; DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=paypal-inc.com; i=asteingruebl@paypal-inc.com; q=dns/txt; s=ppinc; t=1281120742; x=1312656742; h=from:to:date:subject:message-id:references:in-reply-to: content-transfer-encoding:mime-version; z=From:=20"Steingruebl,=20Andy"=20|To:=20Devdatta=20Akhawe=20, =20IETF=20HASMAT=20list=20|Date:=20Fri, =206=20Aug=202010=2012:52:19=20-0600|Subject:=20RE:=20[HA SMAT]=20HSTS=20Threat=20prevalence|Message-ID:=20<5EE049B A3C6538409BBE6F1760F328ABEAD832B390@DEN-MEXMS-001.corp.eb ay.com>|References:=20|In-Reply-To:=20 |Content-Transfer-Encoding:=20quoted-printable |MIME-Version:=201.0; bh=pbJiT9hpuHUEqSxcIfGZkvjf4tNTOVEyc4m8KHP+Zhk=; b=nWqY7oXXof/eu5mjTgrk5buHkiK8nAI8sVhkQ1prOvUaCqfHNH2G9Krc n+KYqEjMlteIw8yvfhq9vT/lX+QCikmibcF+deHXF4+M6mwZ02miuYdtQ o0vQD2m+d9o/ReA; X-EBay-Corp: Yes X-IronPort-AV: E=Sophos;i="4.55,330,1278313200"; d="scan'208";a="71671786" Received: from den-vtenf-001.corp.ebay.com (HELO DEN-MEXHT-003.corp.ebay.com) ([10.101.112.212]) by den-mipot-001.corp.ebay.com with ESMTP; 06 Aug 2010 11:52:21 -0700 Received: from DEN-MEXMS-001.corp.ebay.com ([192.101.150.21]) by DEN-MEXHT-003.corp.ebay.com ([10.241.17.54]) with mapi; Fri, 6 Aug 2010 12:52:21 -0600 From: "Steingruebl, Andy" To: Devdatta Akhawe , IETF HASMAT list Date: Fri, 6 Aug 2010 12:52:19 -0600 Thread-Topic: [HASMAT] HSTS Threat prevalence Thread-Index: Acs1lk+h0O10Cy+WSxqQbgGhZJEkEAAAdJPw Message-ID: <5EE049BA3C6538409BBE6F1760F328ABEAD832B390@DEN-MEXMS-001.corp.ebay.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CFilter: Scanned X-Mailman-Approved-At: Fri, 06 Aug 2010 18:33:19 -0700 Subject: Re: [HASMAT] HSTS Threat prevalence X-BeenThere: hasmat@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: HTTP Application Security Minus Authentication and Transport List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Aug 2010 19:40:37 -0000 > -----Original Message----- > From: hasmat-bounces@ietf.org [mailto:hasmat-bounces@ietf.org] On > Behalf Of Devdatta Akhawe > Sent: Friday, August 06, 2010 11:36 AM > To: IETF HASMAT list > Subject: [HASMAT] HSTS Threat prevalence >=20 > Hi all >=20 > The HSTS specification talks about possible attacks that could be prevent= ed > by the use of HSTS. Do we have any data that suggests these attacks are > actually a concern / being used by attackers anywhere ? I couldn't find a= ny > citation to this effect in the specification. We are actively doing research in this area, but we don't know of any publi= shed work at this point.=20 For the wider audience - do you want to know: 1. Whether this is occurring 2. Its overall frequency/distribution 3. Both Which of these would be most compelling? On a percentage basis the number = of connections being observed by passive network attackers is probably very= small. That doesn't by itself mean to should get rid of TLS. =20 Me - I initially want the answer to #1, and then to #2. - Andy From asteingruebl@paypal-inc.com Fri Aug 6 15:22:55 2010 Return-Path: X-Original-To: hasmat@core3.amsl.com Delivered-To: hasmat@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 117ED28C0E7 for ; Fri, 6 Aug 2010 15:22:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.696 X-Spam-Level: X-Spam-Status: No, score=-4.696 tagged_above=-999 required=5 tests=[AWL=0.421, BAYES_00=-2.599, DNS_FROM_RFC_BOGUSMX=1.482, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lJAA7nptweoi for ; Fri, 6 Aug 2010 15:22:53 -0700 (PDT) Received: from den-mipot-002.corp.ebay.com (den-mipot-002.corp.ebay.com [216.113.175.153]) by core3.amsl.com (Postfix) with ESMTP id B704C3A69B1 for ; Fri, 6 Aug 2010 15:22:53 -0700 (PDT) DomainKey-Signature: s=ppinc; d=paypal-inc.com; c=nofws; q=dns; h=X-EBay-Corp:X-IronPort-AV:Received:Received:From:To:CC: Date:Subject:Thread-Topic:Thread-Index:Message-ID: References:In-Reply-To:Accept-Language:Content-Language: X-MS-Has-Attach:X-MS-TNEF-Correlator:acceptlanguage: Content-Type:Content-Transfer-Encoding:MIME-Version: X-CFilter; b=cW5qgfbV8Ly6/thlVj3kJ4Z+YFFseRyKpWO0F7JmhVXspyLl0Ot/+OIp q375A/lumGz4s4kGEt3tjyInMsisjHy8+l5WB6TazkDKK14uZ4R7ndYVj DNGca/SqkyM6S3q; DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=paypal-inc.com; i=asteingruebl@paypal-inc.com; q=dns/txt; s=ppinc; t=1281133405; x=1312669405; h=from:to:cc:date:subject:message-id:references: in-reply-to:content-transfer-encoding:mime-version; z=From:=20"Steingruebl,=20Andy"=20|To:=20Devdatta=20Akhawe=20, =20Marsh=20Ray=0D=0A=09|CC:=20I ETF=20HASMAT=20list=20|Date:=20Fri,=206 =20Aug=202010=2016:23:23=20-0600|Subject:=20RE:=20[HASMAT ]=20HSTS=20Threat=20prevalence|Message-ID:=20<5EE049BA3C6 538409BBE6F1760F328ABEAD832B53F@DEN-MEXMS-001.corp.ebay.c om>|References:=20=0D=0A=20=09<5EE049BA3C6538409BB E6F1760F328ABEAD832B390@DEN-MEXMS-001.corp.ebay.com>=0D =0A=20=09=0D=0A=20=09<4C5C5F9D.3050107@extendedsub set.com>=0D=0A=20|In-Reply-To:=20 |Content-Transfer-Encoding:=20quoted-printable |MIME-Version:=201.0; bh=WvQMm9ccCDXuWHAuYejgNMj6CGOO8hocv6XQFuemjTU=; b=Xrw1QPh+iYL70RtJp2szwPejt4BCBKUIC5FNfWGWG06fjXEGgGvaA3gw m4fnLg9ZDmjIEm8HOjWrZtneFjF8rHHUc5lyxNxvTefsfDD/gqreqiJeu XJJubms33CbPLwe; X-EBay-Corp: Yes X-IronPort-AV: E=Sophos;i="4.55,331,1278313200"; d="scan'208";a="71730389" Received: from den-vtenf-001.corp.ebay.com (HELO DEN-MEXHT-003.corp.ebay.com) ([10.101.112.212]) by den-mipot-002.corp.ebay.com with ESMTP; 06 Aug 2010 15:23:25 -0700 Received: from DEN-MEXMS-001.corp.ebay.com ([192.101.150.21]) by DEN-MEXHT-003.corp.ebay.com ([10.241.17.54]) with mapi; Fri, 6 Aug 2010 16:23:24 -0600 From: "Steingruebl, Andy" To: Devdatta Akhawe , Marsh Ray Date: Fri, 6 Aug 2010 16:23:23 -0600 Thread-Topic: [HASMAT] HSTS Threat prevalence Thread-Index: Acs1s+UqIe06A+7TTCyMMirLFrLB4gAAdW5w Message-ID: <5EE049BA3C6538409BBE6F1760F328ABEAD832B53F@DEN-MEXMS-001.corp.ebay.com> References: <5EE049BA3C6538409BBE6F1760F328ABEAD832B390@DEN-MEXMS-001.corp.ebay.com> <4C5C5F9D.3050107@extendedsubset.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CFilter: Scanned X-Mailman-Approved-At: Fri, 06 Aug 2010 18:33:19 -0700 Cc: IETF HASMAT list Subject: Re: [HASMAT] HSTS Threat prevalence X-BeenThere: hasmat@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: HTTP Application Security Minus Authentication and Transport List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Aug 2010 22:22:55 -0000 > -----Original Message----- > From: Devdatta Akhawe [mailto:dev.akhawe@gmail.com] > Sent: Friday, August 06, 2010 3:08 PM > To: Marsh Ray > Cc: Steingruebl, Andy; IETF HASMAT list > Subject: Re: [HASMAT] HSTS Threat prevalence >=20 > >> > >> #1 would be good - for a reasonably representative sample (i.e. no > >> stories ' I once sat in a cafe and ... '). > > > > How about "I've sat in cafes on multiple occasions with professional > > pen-testers who told me that they employ these techniques quite > > effectively on a regular basis"? >=20 > I am not sure if people targeted by professional pentesters are a > "representative sample" of the general web user populace. One easy approach we considered was thinking of likely places for these typ= es of attacks, and seeing if w can detect them. One easy example is airpor= ts. Look for wifi in an airport and you'll usually see quite a number of "f= ree wifi" SSIDs, all with slightly carrying names. Who knows which one is = the real one. I'd like to do a little experimenting on how many of those a= re rogue. - Andy From stpeter@stpeter.im Fri Aug 20 11:07:41 2010 Return-Path: X-Original-To: hasmat@core3.amsl.com Delivered-To: hasmat@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8884E3A6B11 for ; Fri, 20 Aug 2010 11:07:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.496 X-Spam-Level: X-Spam-Status: No, score=-102.496 tagged_above=-999 required=5 tests=[AWL=0.103, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4k8a0yry9v3N for ; Fri, 20 Aug 2010 11:07:40 -0700 (PDT) Received: from stpeter.im (stpeter.im [207.210.219.233]) by core3.amsl.com (Postfix) with ESMTP id 6CBBF3A6AFC for ; Fri, 20 Aug 2010 11:07:37 -0700 (PDT) Received: from squire.local (dsl-140-248.dynamic-dsl.frii.net [216.17.140.248]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id BDD5540074 for ; Fri, 20 Aug 2010 12:10:07 -0600 (MDT) Message-ID: <4C6EC48A.5020803@stpeter.im> Date: Fri, 20 Aug 2010 12:08:10 -0600 From: Peter Saint-Andre User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1.11) Gecko/20100711 Thunderbird/3.0.6 MIME-Version: 1.0 To: hasmat@ietf.org X-Enigmail-Version: 1.0.1 OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Subject: [HASMAT] moving forward X-BeenThere: hasmat@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: HTTP Application Security Minus Authentication and Transport List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 20 Aug 2010 18:07:41 -0000 Following up on the successful BoF we held in Maastricht, I'd like to keep us moving toward formation of a working group. Here are some open tasks: 1. Chairs. Tobias Gondrom (currently co-chair of the LTANS WG in the Security Area) has stepped forward to volunteer and I think he'll make a good co-chair. Thanks, Tobias! However, we need someone to work with Tobias, preferably someone with (a) more experience in the Applications Area and (b) strong knowledge of HTTP. Please contact me if you're interested or you would like to suggest someone else. 2. Charter. We had some feedback at the BoF about charter revisions, especially focusing on the three drafts under immediate consideration and removing the text about developing a long-term framework for web security. Jeff or Hannes, could you send updated charter text to the list for discussion? 3. Name. Some people have said that "HASMAT" isn't very descriptive of the subject matter, and that we might want something like "WEBSEC". As long as folks don't think "WEBSEC" means that we'd be working on everything under the sun related to the security of the web, I'd be fine with a name like that. Other suggestions are welcome. Thanks! Peter -- Peter Saint-Andre https://stpeter.im/ From kaie@kuix.de Mon Aug 23 03:49:46 2010 Return-Path: X-Original-To: hasmat@core3.amsl.com Delivered-To: hasmat@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9D3A43A69D8 for ; Mon, 23 Aug 2010 03:49:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.853 X-Spam-Level: X-Spam-Status: No, score=-1.853 tagged_above=-999 required=5 tests=[AWL=-0.743, BAYES_05=-1.11] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oB9iXDK1sBx9 for ; Mon, 23 Aug 2010 03:49:45 -0700 (PDT) Received: from s15277822.onlinehome-server.info (s15277822.onlinehome-server.info [87.106.189.147]) by core3.amsl.com (Postfix) with ESMTP id 783E03A67DB for ; Mon, 23 Aug 2010 03:49:44 -0700 (PDT) Received: from [192.168.2.11] (p4FF350F6.dip.t-dialin.net [79.243.80.246]) by s15277822.onlinehome-server.info (Postfix) with ESMTPSA id 4ABBE56E97E; Mon, 23 Aug 2010 12:50:17 +0200 (CEST) Message-ID: <4C725267.3010908@kuix.de> Date: Mon, 23 Aug 2010 12:50:15 +0200 From: Kai Engert User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.8) Gecko/20100806 Fedora/3.1.2-1.fc13 Lightning/1.0b2pre Thunderbird/3.1.2 MIME-Version: 1.0 To: Peter Saint-Andre References: <4C6EC48A.5020803@stpeter.im> In-Reply-To: <4C6EC48A.5020803@stpeter.im> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: hasmat@ietf.org Subject: Re: [HASMAT] moving forward X-BeenThere: hasmat@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: HTTP Application Security Minus Authentication and Transport List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 23 Aug 2010 10:49:46 -0000 On 20.08.2010 20:08, Peter Saint-Andre wrote: > 3. Name. Some people have said that "HASMAT" isn't very descriptive of > the subject matter, and that we might want something like "WEBSEC". As > long as folks don't think "WEBSEC" means that we'd be working on > everything under the sun related to the security of the web, I'd be fine > with a name like that. Other suggestions are welcome. "websec" sounds indeed very general, while the meaning of "hasmat" focuses on a smaller subset. I wanted to propose "WebAppSec", but there's already http://www.webappsec.org/ What about HTSEC ? (hypertext security) Kai From tobias.gondrom@gondrom.org Mon Aug 23 07:59:35 2010 Return-Path: X-Original-To: hasmat@core3.amsl.com Delivered-To: hasmat@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 817FA3A6817 for ; Mon, 23 Aug 2010 07:59:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -93.484 X-Spam-Level: X-Spam-Status: No, score=-93.484 tagged_above=-999 required=5 tests=[AWL=-0.722, BAYES_50=0.001, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FM_DDDD_TIMES_2=1.999, HELO_DYNAMIC_IPADDR=2.426, HELO_EQ_DE=0.35, RDNS_DYNAMIC=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4iEVNAUOVTxZ for ; Mon, 23 Aug 2010 07:59:34 -0700 (PDT) Received: from lvps83-169-7-107.dedicated.hosteurope.de (lvps83-169-7-107.dedicated.hosteurope.de [83.169.7.107]) by core3.amsl.com (Postfix) with ESMTP id 0027B3A657C for ; Mon, 23 Aug 2010 07:59:33 -0700 (PDT) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=default; d=gondrom.org; b=VgI2UKu9u7ZRKapobZQajSKMkqL+KpaCJ8KLvYTRUD97pdbp+m1TfZKXzKdqyFmx9cLPArzPHV7TEyvsoqGKxrW0KG8lA2qyTqb0vuRiqSraIURS3YwhM3Bg235NozLK; h=Received:Received:Message-ID:Date:From:User-Agent:MIME-Version:To:Subject:X-Priority:References:In-Reply-To:X-Enigmail-Version:Content-Type:Content-Transfer-Encoding; Received: (qmail 28086 invoked from network); 23 Aug 2010 16:59:03 +0200 Received: from 94-194-102-93.zone8.bethere.co.uk (HELO seraphim.heaven) (94.194.102.93) by lvps83-169-7-107.dedicated.hosteurope.de with (DHE-RSA-AES256-SHA encrypted) SMTP; 23 Aug 2010 16:59:03 +0200 Message-ID: <4C728CC5.4070703@gondrom.org> Date: Mon, 23 Aug 2010 15:59:17 +0100 From: Tobias Gondrom User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.8) Gecko/20100802 SUSE/3.1.2 Lightning/1.0b2 Thunderbird/3.1.2 MIME-Version: 1.0 To: hasmat@ietf.org X-Priority: 4 (Low) References: <4C6EC48A.5020803@stpeter.im> In-Reply-To: <4C6EC48A.5020803@stpeter.im> X-Enigmail-Version: 1.1.1 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [HASMAT] moving forward X-BeenThere: hasmat@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: HTTP Application Security Minus Authentication and Transport List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 23 Aug 2010 14:59:35 -0000 Hi all, just a quick introduction for the ones who might not already know me: Currently living in London, UK (timezone UTC/GMT+1). My background is in Web application security, where until recently I spent the last couple of years heading the security department of an ISV. I've been co-chairing the LTANS WG in the security area for a couple of years until this September when we successfully finish its work and close it. Over the years I became a big fan of "rough consensus and running code". ;-) For me these principles helped a lot to get things done. Besides enjoying IETF work, I am also member of OWASP (Open Web Application Security Project) and probably have seen every web app security problem in the book (and some which aren't). When I read the drafts and saw the BOF proposal before Maastricht, I feel very excited about it. In the past I always worked around some of the problems posed by underlying infrastructure and this is a great opportunity to remedy some of the problems at the root! Whatever I can do to help (even if it's not directly related to the WG), please feel free to contact me via email, phone, skype,... and of course during IETF meetings. I am looking forward to work with you, the progress of the WG, its charter and the three initial drafts and getting things done! Many greetings, Tobias Ps.: as Peter mentioned we are still looking for a co-chair: Personally, I feel a WG is faster and more productive with two co-chairs then just one. So if you think about co-chairing with me, please please drop me a note. Tobias Gondrom Sloan Fellowship 2009 London Business School email: tobias.gondrom@gondrom.org mobile: +447521003005 On 08/20/2010 07:08 PM, Peter Saint-Andre wrote: > Following up on the successful BoF we held in Maastricht, I'd like to > keep us moving toward formation of a working group. Here are some open > tasks: > > 1. Chairs. Tobias Gondrom (currently co-chair of the LTANS WG in the > Security Area) has stepped forward to volunteer and I think he'll make a > good co-chair. Thanks, Tobias! However, we need someone to work with > Tobias, preferably someone with (a) more experience in the Applications > Area and (b) strong knowledge of HTTP. Please contact me if you're > interested or you would like to suggest someone else. > > 2. Charter. We had some feedback at the BoF about charter revisions, > especially focusing on the three drafts under immediate consideration > and removing the text about developing a long-term framework for web > security. Jeff or Hannes, could you send updated charter text to the > list for discussion? > > 3. Name. Some people have said that "HASMAT" isn't very descriptive of > the subject matter, and that we might want something like "WEBSEC". As > long as folks don't think "WEBSEC" means that we'd be working on > everything under the sun related to the security of the web, I'd be fine > with a name like that. Other suggestions are welcome. > > Thanks! > > Peter > From tobias.gondrom@gondrom.org Mon Aug 23 09:18:39 2010 Return-Path: X-Original-To: hasmat@core3.amsl.com Delivered-To: hasmat@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 782EA3A68D8 for ; Mon, 23 Aug 2010 09:18:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -94.712 X-Spam-Level: X-Spam-Status: No, score=-94.712 tagged_above=-999 required=5 tests=[AWL=0.650, BAYES_00=-2.599, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FM_DDDD_TIMES_2=1.999, HELO_DYNAMIC_IPADDR=2.426, HELO_EQ_DE=0.35, RDNS_DYNAMIC=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ft3TKAY8uoOB for ; Mon, 23 Aug 2010 09:18:38 -0700 (PDT) Received: from lvps83-169-7-107.dedicated.hosteurope.de (lvps83-169-7-107.dedicated.hosteurope.de [83.169.7.107]) by core3.amsl.com (Postfix) with ESMTP id B0AFB3A68BF for ; Mon, 23 Aug 2010 09:18:37 -0700 (PDT) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=default; d=gondrom.org; b=G+ZzaO/kM7r5zaOd8RQmwbILAxNDjbfgPr+z7hBnezPY6s5xIiYaszys7mD+sRvG5IzEfLNdIFgT2WNihQjDft2+9fO1MrY3O+5CG8gMCSLHL25v9RfmOtua3wSIXDOK; h=Received:Received:Message-ID:Date:From:User-Agent:MIME-Version:To:Subject:References:In-Reply-To:X-Enigmail-Version:Content-Type:Content-Transfer-Encoding; Received: (qmail 20440 invoked from network); 23 Aug 2010 18:17:23 +0200 Received: from 94-194-102-93.zone8.bethere.co.uk (HELO seraphim.heaven) (94.194.102.93) by lvps83-169-7-107.dedicated.hosteurope.de with (DHE-RSA-AES256-SHA encrypted) SMTP; 23 Aug 2010 18:17:23 +0200 Message-ID: <4C729F21.3020900@gondrom.org> Date: Mon, 23 Aug 2010 17:17:37 +0100 From: Tobias Gondrom User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.8) Gecko/20100802 SUSE/3.1.2 Lightning/1.0b2 Thunderbird/3.1.2 MIME-Version: 1.0 To: hasmat@ietf.org References: <4C6EC48A.5020803@stpeter.im> <4C725267.3010908@kuix.de> In-Reply-To: <4C725267.3010908@kuix.de> X-Enigmail-Version: 1.1.1 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [HASMAT] moving forward - WG name X-BeenThere: hasmat@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: HTTP Application Security Minus Authentication and Transport List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 23 Aug 2010 16:18:39 -0000 believe "websec" was proposed during BOF meeting and actually "hasmat" reminded me of "hazardous materials" at first, so would support to go for a different name if people like to. Have no problem if the name is general, after all the charter and not the name determines WG scope (and as the name will stay even if you may recharter at some point, so general can rather be an advantage for a name). htsec is fine for me, too (though personally I may slightly prefer websec). Would be against webappsec due to ambiguity and actually adding "app" in the middle doesn't help and makes the name unnecessarily long (there are practical benefits from short WG names). Tobias would agree with websec On 08/23/2010 11:50 AM, Kai Engert wrote: > On 20.08.2010 20:08, Peter Saint-Andre wrote: >> 3. Name. Some people have said that "HASMAT" isn't very descriptive of >> the subject matter, and that we might want something like "WEBSEC". As >> long as folks don't think "WEBSEC" means that we'd be working on >> everything under the sun related to the security of the web, I'd be fine >> with a name like that. Other suggestions are welcome. > > "websec" sounds indeed very general, while the meaning of "hasmat" > focuses on a smaller subset. > > I wanted to propose "WebAppSec", but there's already > http://www.webappsec.org/ > > What about HTSEC ? (hypertext security) > > Kai > > _______________________________________________ > HASMAT mailing list > HASMAT@ietf.org > https://www.ietf.org/mailman/listinfo/hasmat From marsh@extendedsubset.com Mon Aug 23 09:27:34 2010 Return-Path: X-Original-To: hasmat@core3.amsl.com Delivered-To: hasmat@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5D7803A68CD for ; Mon, 23 Aug 2010 09:27:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.077 X-Spam-Level: X-Spam-Status: No, score=-2.077 tagged_above=-999 required=5 tests=[AWL=0.522, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LTrih3KmqDQh for ; Mon, 23 Aug 2010 09:27:33 -0700 (PDT) Received: from mho-01-ewr.mailhop.org (mho-01-ewr.mailhop.org [204.13.248.71]) by core3.amsl.com (Postfix) with ESMTP id 215933A689C for ; Mon, 23 Aug 2010 09:27:33 -0700 (PDT) Received: from xs01.extendedsubset.com ([69.164.193.58]) by mho-01-ewr.mailhop.org with esmtpa (Exim 4.68) (envelope-from ) id 1OnZsU-0006y1-EF; Mon, 23 Aug 2010 16:28:06 +0000 Received: from [192.168.1.15] (localhost [127.0.0.1]) by xs01.extendedsubset.com (Postfix) with ESMTP id 073BC608D; Mon, 23 Aug 2010 16:28:05 +0000 (UTC) X-Mail-Handler: MailHop Outbound by DynDNS X-Originating-IP: 69.164.193.58 X-Report-Abuse-To: abuse@dyndns.com (see http://www.dyndns.com/services/mailhop/outbound_abuse.html for abuse reporting information) X-MHO-User: U2FsdGVkX1+0Qi1E9Zr8pHD3iEy0d7LXbUFGCUvP2AQ= Message-ID: <4C72A195.4050507@extendedsubset.com> Date: Mon, 23 Aug 2010 11:28:05 -0500 From: Marsh Ray User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.11) Gecko/20100713 Thunderbird/3.0.6 MIME-Version: 1.0 To: Tobias Gondrom References: <4C6EC48A.5020803@stpeter.im> <4C725267.3010908@kuix.de> <4C729F21.3020900@gondrom.org> In-Reply-To: <4C729F21.3020900@gondrom.org> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: hasmat@ietf.org Subject: Re: [HASMAT] moving forward - WG name X-BeenThere: hasmat@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: HTTP Application Security Minus Authentication and Transport List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 23 Aug 2010 16:27:34 -0000 Perhaps it depends on what the group wants to do? Websec is nice. Not a revolutionary name. It seems appropriate for this sentence from the proposed charter: > The goal of this working group is to standardize a small number of > selected specifications that have proven to improve security of Internet > Web applications. Personally, I think the current name is pretty awesome. - Marsh On 08/23/2010 11:17 AM, Tobias Gondrom wrote: > believe "websec" was proposed during BOF meeting and actually "hasmat" > reminded me of "hazardous materials" at first, so would support to go > for a different name if people like to. > Have no problem if the name is general, after all the charter and not > the name determines WG scope (and as the name will stay even if you may > recharter at some point, so general can rather be an advantage for a name). > > htsec is fine for me, too (though personally I may slightly prefer websec). > Would be against webappsec due to ambiguity and actually adding "app" in > the middle doesn't help and makes the name unnecessarily long (there are > practical benefits from short WG names). > > Tobias > > > would agree with websec > > On 08/23/2010 11:50 AM, Kai Engert wrote: >> On 20.08.2010 20:08, Peter Saint-Andre wrote: >>> 3. Name. Some people have said that "HASMAT" isn't very descriptive of >>> the subject matter, and that we might want something like "WEBSEC". As >>> long as folks don't think "WEBSEC" means that we'd be working on >>> everything under the sun related to the security of the web, I'd be fine >>> with a name like that. Other suggestions are welcome. >> >> "websec" sounds indeed very general, while the meaning of "hasmat" >> focuses on a smaller subset. >> >> I wanted to propose "WebAppSec", but there's already >> http://www.webappsec.org/ >> >> What about HTSEC ? (hypertext security) >> >> Kai >> >> _______________________________________________ >> HASMAT mailing list >> HASMAT@ietf.org >> https://www.ietf.org/mailman/listinfo/hasmat > > _______________________________________________ > HASMAT mailing list > HASMAT@ietf.org > https://www.ietf.org/mailman/listinfo/hasmat From Jeff.Hodges@KingsMountain.com Tue Aug 24 16:39:03 2010 Return-Path: X-Original-To: hasmat@core3.amsl.com Delivered-To: hasmat@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E1F043A6953 for ; Tue, 24 Aug 2010 16:39:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100.804 X-Spam-Level: X-Spam-Status: No, score=-100.804 tagged_above=-999 required=5 tests=[AWL=-0.953, BAYES_40=-0.185, IP_NOT_FRIENDLY=0.334, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yvOBPef8MdV5 for ; Tue, 24 Aug 2010 16:39:02 -0700 (PDT) Received: from cpoproxy2-pub.bluehost.com (cpoproxy2-pub.bluehost.com [67.222.39.38]) by core3.amsl.com (Postfix) with SMTP id C703A3A6960 for ; Tue, 24 Aug 2010 16:39:02 -0700 (PDT) Received: (qmail 7308 invoked by uid 0); 24 Aug 2010 23:39:35 -0000 Received: from unknown (HELO box514.bluehost.com) (74.220.219.114) by cpoproxy2.bluehost.com with SMTP; 24 Aug 2010 23:39:35 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=default; d=kingsmountain.com; h=Received:Message-ID:Date:From:User-Agent:MIME-Version:To:Subject:Content-Type:Content-Transfer-Encoding:X-Identified-User; b=Q3nmMz9+QWR4ng3KZc9cR3T0lqP3/T6DpHKikNs8sU2E4ZnwsXvTOSUWDYLgB+X6YAXN+gnGmcPcUjAbDbO9BrXNy9zhQxDD8aMDXYky8quGgp8f8dIuctcWlwrewHM0; Received: from outbound4.ebay.com ([216.113.168.128] helo=[10.244.48.205]) by box514.bluehost.com with esmtpsa (TLSv1:AES256-SHA:256) (Exim 4.69) (envelope-from ) id 1Oo35b-0005eO-Fr for hasmat@ietf.org; Tue, 24 Aug 2010 17:39:35 -0600 Message-ID: <4C745837.50104@KingsMountain.com> Date: Tue, 24 Aug 2010 16:39:35 -0700 From: =JeffH User-Agent: Thunderbird 2.0.0.24 (X11/20100411) MIME-Version: 1.0 To: IETF HASMAT list Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Identified-User: {11025:box514.bluehost.com:kingsmou:kingsmountain.com} {sentby:smtp auth 216.113.168.128 authed with jeff.hodges+kingsmountain.com} Subject: Re: [HASMAT] moving forward X-BeenThere: hasmat@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: HTTP Application Security Minus Authentication and Transport List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Aug 2010 23:39:04 -0000 Thanks Peter for keeping the ball moving. > Following up on the successful BoF we held in Maastricht, yea! thanks all who attended (it was standing-room-only) > I'd like to > keep us moving toward formation of a working group. Here are some open > tasks: > > 1. Chairs. Tobias Gondrom (currently co-chair of the LTANS WG in the > Security Area) has stepped forward to volunteer and I think he'll make a > good co-chair. Thanks, Tobias! Indeed, thanks Tobias. > However, we need someone to work with Tobias, thoughts / volunteers? I'm presently slated to hack on specs, thus am not a chair candidate. > 2. Charter. We had some feedback at the BoF about charter revisions, > especially focusing on the three drafts under immediate consideration > and removing the text about developing a long-term framework for web > security. Jeff or Hannes, could you send updated charter text to the > list for discussion? working on it. tomorrow or Wed. > 3. Name. Some people have said that "HASMAT" isn't very descriptive of > the subject matter, and that we might want something like "WEBSEC". As > long as folks don't think "WEBSEC" means that we'd be working on > everything under the sun related to the security of the web, I'd be fine > with a name like that. Other suggestions are welcome It isn't descriptive unless one knows what the acronym represents -- HTTP app sec minus authn & transport -- and then it's very descriptive. It's also sort of an "inside joke" in that HTTP authn is something that gets derided often but no one has really wanted to take up and try to do something about (AFAIK Peter S-A came up with the HASMAT moniker), and transport security, ie TLS/SSL, is addressed elsewhere already, and no one really wants to step on their toes. Hence the "HASMAT" double-entendre. That said we could use "websec" with the understanding (and explicitness in the charter) that it's "minus authn & transport". "websec" will be easier for IETF newbies to find and grok than "hasmat". Tho it might get a bit confusing wrt the in-genesis W3C "WebAppSec" WG. more thoughts? =JeffH From barryleiba.mailing.lists@gmail.com Tue Aug 24 18:17:26 2010 Return-Path: X-Original-To: hasmat@core3.amsl.com Delivered-To: hasmat@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B125A3A6A65 for ; Tue, 24 Aug 2010 18:17:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.765 X-Spam-Level: X-Spam-Status: No, score=-2.765 tagged_above=-999 required=5 tests=[AWL=-0.166, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bw6OE3ah640L for ; Tue, 24 Aug 2010 18:17:26 -0700 (PDT) Received: from mail-iw0-f172.google.com (mail-iw0-f172.google.com [209.85.214.172]) by core3.amsl.com (Postfix) with ESMTP id D2F7F3A6900 for ; Tue, 24 Aug 2010 18:17:25 -0700 (PDT) Received: by iwn3 with SMTP id 3so93061iwn.31 for ; Tue, 24 Aug 2010 18:17:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:received:reply-to :in-reply-to:references:date:message-id:subject:from:to:content-type; bh=kW8qyqzZSe+9b8XUFcGPSbJIgeHa4EY7MbXPIjBRhhE=; b=G7BWV1QRCraB1rFDQ+Bi7QV3dvD/7k1XPfnfF9YtbhHa/6RhvseFBgLT5oEDkke+8F n8JjCkhtZOI5VEPBUJ2YwmPHnBzgRLjbS17Nax03Z5f+uR0BIbnK8Zo1fk6jg+x5g1aF Hyb1v6p5RXBgVK12zKChWsntsF/heb57ijxNk= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:reply-to:in-reply-to:references:date:message-id :subject:from:to:content-type; b=RbK8Y741VOs6TNkrUs4LMyTi2SKC4ao3Zho5BzuTpNQmXG7fg3yeeMlUhOFxKoazeJ aBclB1Z4sL4dCyKMZnc0tD2A1u/gkYFuVhse7eoV4ab6yqeCoSDchcCinSp8iO3GB1J6 /yyVg/rV+EBjiuEF3IGSPzGw6V3QHCQJ4GnWo= MIME-Version: 1.0 Received: by 10.42.1.7 with SMTP id 7mr2411706ice.52.1282699078807; Tue, 24 Aug 2010 18:17:58 -0700 (PDT) Received: by 10.42.5.137 with HTTP; Tue, 24 Aug 2010 18:17:58 -0700 (PDT) In-Reply-To: <4C745837.50104@KingsMountain.com> References: <4C745837.50104@KingsMountain.com> Date: Tue, 24 Aug 2010 21:17:58 -0400 Message-ID: From: Barry Leiba To: IETF HASMAT list Content-Type: text/plain; charset=ISO-8859-1 Subject: Re: [HASMAT] moving forward X-BeenThere: hasmat@ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: barryleiba@computer.org List-Id: HTTP Application Security Minus Authentication and Transport List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 25 Aug 2010 01:17:26 -0000 As I've said to Jeff back in Pays-Bas, I'm less concerned about the name than about the charter. The problem description at the BoF said that a main issue is that this stuff has been previously dealt with in a haphazard manner. We then looked at three haphazard drafts, which the charter proposes to standardize. This doesn't address the core problem. What does address the core problem is the part about studying the problem space. From one of the proposed charters: > In addition, this working group will consider the overall topic of HTTP > application security and compose a "problem statement and requirements" > document that can be used to guide further work. I'd like to see much more emphasis placed on this part, and have the scope of this hashed out a bit more. I think the focus of the WG should be on this, with the three existing drafts as something we do along the way... rather than the other way 'round, as it is now. Barry From bsterne@mozilla.com Tue Aug 31 13:38:31 2010 Return-Path: X-Original-To: hasmat@core3.amsl.com Delivered-To: hasmat@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id ED6703A6AFB for ; Tue, 31 Aug 2010 13:38:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.001 X-Spam-Level: X-Spam-Status: No, score=0.001 tagged_above=-999 required=5 tests=[BAYES_50=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OqGKIlbofQZ0 for ; Tue, 31 Aug 2010 13:38:29 -0700 (PDT) Received: from dm-mail01.mozilla.org (dm-mail01.mozilla.org [63.245.208.150]) by core3.amsl.com (Postfix) with ESMTP id 3C51F3A6891 for ; Tue, 31 Aug 2010 13:38:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at mozilla.org Received: from [10.250.1.47] (v74-nslb.mozilla.org [10.2.74.4]) (Authenticated sender: bsterne@mozilla.com) by dm-mail01.mozilla.org (Postfix) with ESMTP id 286E3B801E; Tue, 31 Aug 2010 13:38:49 -0700 (PDT) Message-ID: <4C7D6949.5040401@mozilla.com> Date: Tue, 31 Aug 2010 13:42:49 -0700 From: Brandon Sterne User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.9) Gecko/20100825 Thunderbird/3.1.3 MIME-Version: 1.0 To: Peter Saint-Andre References: <4C6EC48A.5020803@stpeter.im> In-Reply-To: <4C6EC48A.5020803@stpeter.im> X-Enigmail-Version: 1.1.1 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: hasmat@ietf.org Subject: Re: [HASMAT] moving forward X-BeenThere: hasmat@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: HTTP Application Security Minus Authentication and Transport List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 31 Aug 2010 20:38:31 -0000 On 08/20/2010 11:08 AM, Peter Saint-Andre wrote: > Following up on the successful BoF we held in Maastricht, I'd like to > keep us moving toward formation of a working group. Here are some open > tasks: Thanks, Peter, for keeping the ball rolling here. > 2. Charter. We had some feedback at the BoF about charter revisions, > especially focusing on the three drafts under immediate consideration > and removing the text about developing a long-term framework for web > security. Not being present at the BoF, I missed the discussion about removing the creation of a long-term security framework. If the group focuses on standardizing a small set of security mechanisms won't it be contributing to the "sprinkling" problem in the first part of the Objectives and Scope section? > 3. Name. Some people have said that "HASMAT" isn't very descriptive of > the subject matter, and that we might want something like "WEBSEC". As > long as folks don't think "WEBSEC" means that we'd be working on > everything under the sun related to the security of the web, I'd be fine > with a name like that. Other suggestions are welcome. Personally, I do think WEBAPPSEC is the right name. Someone pointed out that webappsec.org is registered already, but that space is occupied by the Web Application Security Consortium who generally go by the acronym WASC. Other than the domain issue, is this still a problem? Cheers, Brandon