Subject: Re: [httpwg/http-extensions] MitM detection (#617)

From: HTTP issue updates <[email-masked]>
Date: Fri, 11 May 2018 12:14:06 -0700

Thirty-two bits from the exporter seems like a reasonable mitigation.  That's fairly low cost.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/617#issuecomment-388459573

---

From: HTTP issue updates <[email-masked]>
Date: Fri, 11 May 2018 17:42:11 -0700

The only wrinkle is that they might be all zero.  If settings parsers return 0 and the exporter returns an all zero 32-bit value, then there is a possibility of a false positive.

I think that we can either force a bit to one and lose a bit, or emphasize that endpoints have to check for the *presence* of the setting as well as its value.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/617#issuecomment-388517686