Subject: [Tools-discuss] tracker login link sending credentials in clear

From: Stephen Farrell <[email-masked]>
Date: Tue, 25 Oct 2011 09:47:24 +0100

Hi all,

First, thanks for the great tools. I don't know
what we'd do without 'em! And of course having
read that, you just know its gonna be immediately
followed by a problem report:-)

I thought that the tracker insisted on logins being
sent via TLS. That certainly is normally the case
for me since I've bookmarked https URIs and those
are also in my history so I normally only see the
tracker over TLS.

However, I followed a link [1] from a "last call
expired" mail which lead me to a http URI that
has this link for login [2]. That appears to me
to be sending credentials in clear over the
network.

I'm not sure what's the easy fix here, but it'd
be worth a look when someone has a chance. Putting
https URIs in the mails might be a workaround.
Even re-directing would change a potential passive
attack into a requirement for a MITM which might
be something.

Note - I don't think "force everyone to run over
TLS all the time" is necessarily the right answer.
I'd be fine with that, but there has been some push
back on that on [email-masked] - even though I disagree
with the comments there and I'm not sure if anyone
other than the original poster was concerned,
nonetheless that obvious answer might not be the one
to go for without going to the discuss list first.
(Eek;-)

Thanks again for all your great work,
S.

[1] http://datatracker.ietf.org/doc/draft-ietf-kitten-sasl-openid/
[2] 
http://datatracker.ietf.org/accounts/login/?next=/doc/draft-ietf-kitten-sasl-openid/

---

From: Frank Ellermann <[email-masked]>
Date: Tue, 25 Oct 2011 13:17:10 +0200

On 25 October 2011 10:47, Stephen Farrell wrote:

> That appears to me to be sending credentials in
> clear over the network.

With the help of www.rexswain.com/httpview.html
I think you are right (AUTH BASIC).  And I vaguely
recall that the tools server supported AUTH DIGEST
some years ago -- not exactly ideal, it still needs
the password in a database, but better than BASIC.

> I'm not sure what's the easy fix here

The draft you tried to get is supposed to suggest
a "fix", isn't it?  <gd&r>

-Frank

---

From: Mark Nottingham <[email-masked]>
Date: Tue, 25 Oct 2011 22:24:56 +1100

Indeed, it's using Basic authentication; simply changing to Digest would be a step in the right direction...

http://redbot.org/webui.py?id=bU1W8v

On 25/10/2011, at 7:47 PM, Stephen Farrell wrote:

> [2] http://datatracker.ietf.org/accounts/login/?next=/doc/draft-ietf-kitten-sasl-openid/ 
> 
> 
> _______________________________________________
> Tools-discuss mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tools-discuss

--
Mark Nottingham   http://www.mnot.net/

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 25 Oct 2011 07:55:51 -0700

> to go for without going to the discuss list first.

It is about time that the IETF had that discussion. We are recently seeing some sites (such as Google) going all-TLS-all-the-time getting very positive responses in the media. The best place for that discussion, which would hopefully be accompanied by a draft or two, would be SAAG. If only we knew how to contact on of the Security ADs....

--Paul Hoffman

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 25 Oct 2011 16:09:19 +0100

> It is about time that the IETF had that discussion. We are recently seeing some sites (such as Google) going all-TLS-all-the-time getting very positive responses in the media. The best place for th…

Well, if you'd been on the ball a bit earlier, with a bit
of sniffing, you could've pretended to be a security AD;-)

Given that its too late for drafts for this time, would
you be up for doing a couple of slides for saag to kick
off a discussion on this?

S.

---

From: Henrik Levkowetz <[email-masked]>
Date: Tue, 25 Oct 2011 20:08:06 +0200

Stephen, Frank, 

> the password in a database, but better than BASIC.

The tools site indeed uses digest auth, and only the
digest (not the password) is stored.

The datatracker unfortunately only uses basic auth.

>> I'm not sure what's the easy fix here

I intend to change the login link to use https as a
first step, then work towards a transition to digest
auth.

Best regards,

	Henrik