Subject: [apps-discuss] WebFinger should be HTTPS only

From: Mike Jones <[email-masked]>
Date: Tue, 11 Sep 2012 17:43:57 +0000

Having looked at the WebFinger specification a bit more, I recently realized that it currently does not require TLS to be used.  Section 5.1 - Performing a WebFinger Query - currently begins "The first step a client must perform in executing a WebFinger query is to query for the host metadata using HTTPS or HTTP".  This concerns me, since this may enable classes of phishing attacks in some situations.

I would therefore request that the specification be updated to prohibit non-TLS connections.

                                                            Thank you,
                                                            -- Mike

---

From: Mikael Nordfeldth <[email-masked]>
Date: Tue, 11 Sep 2012 20:40:24 +0200

> prohibit non-TLS connections.

Given that a lot of users don't trust several of today's main 
certificate authorities, I think it is an unnecessary requirement to 
force HTTPS usage on WebFinger.

Should HTTPS be forced, reasonably you should also verify all WF 
providers' certificates thoroughly. It is a very unrealistic situation 
that this would give a reliable user experience. Not only the fact that 
we'd all have to have the same idea on who's a valid CA (I for one have 
removed several big CAs from /etc/ssl/certs), but also that Webfinger 
would only be deployable by administrators with ability to enable SSL - 
ruling out a lot of same-IP-virtual-hosting as of today.

And if HTTPS certificate validation is not a MUST then I'd make the 
argument that HTTP is equally trustworthy.

Either way I have personally never thought of using Webfinger as means 
of _authenticating_ more than having entries pointing to an OpenID 
provider or similar. And in that case I think it would be noticable 
enough for an end-user that one has been prompted with a phishing 
attempt when their OpenID Provider isn't what was expected.

-- 
Mikael Nordfeldth
http://blog.mmn-o.se/
[email-masked]
+46705657637

---

From: Melvin Carvalho <[email-masked]>
Date: Tue, 11 Sep 2012 21:14:44 +0200

On 11 September 2012 20:40, Mikael Nordfeldth <[email-masked]> wrote:

> Given that a lot of users don't trust several of today's main certificate
> authorities, I think it is an unnecessary requirement to force HTTPS usage
> on WebFinger.
>
> providers' certificates thoroughly. It is a very unrealistic situation that
> this would give a reliable user experience. Not only the fact that we'd all
> have to have the same idea on who's a valid CA (I for one have removed
> several big CAs from /etc/ssl/certs), but also that Webfinger would only be
> deployable by administrators with ability to enable SSL - ruling out a lot
> of same-IP-virtual-hosting as of today.
>
> Either way I have personally never thought of using Webfinger as means of
> _authenticating_ more than having entries pointing to an OpenID provider or
> similar. And in that case I think it would be noticable enough for an
> end-user that one has been prompted with a phishing attempt when their
> OpenID Provider isn't what was expected.
>

Perhaps an interesting data point is the following list of diaspora (which
supports WF) hubs:

http://podupti.me/

HTTP is marked in green and HTTPS is marked in red.

Surprising to me was to see that over 90% of the hubs are actually HTTPS,
as I might have expected the opposite to be the case!

>
> --
> Mikael Nordfeldth
> http://blog.mmn-o.se/
> [email-masked]
> +46705657637
> ______________________________**_________________
> apps-discuss mailing list
> [email-masked]
> https://www.ietf.org/mailman/**listinfo/apps-discuss<https://www.ietf.org/mailman/listinfo/apps-discuss>
>

---

From: Evan Prodromou <[email-masked]>
Date: Tue, 11 Sep 2012 15:16:09 -0400

On 12-09-11 01:43 PM, Mike Jones wrote:
>
> Having looked at the WebFinger specification a bit more, I recently 
> realized that it currently does not require TLS to be used.  Section 
> 5.1 - Performing a WebFinger Query -- currently begins "The first step 
> a client must perform in executing a WebFinger query is to query for 
> the host metadata using HTTPS or HTTP".  This concerns me, since this 
> may enable classes of phishing attacks in some situations.
>
>
I think that HTTPS should be required /in those situations/, then.

Here's the language from RFC 6415:

    Applications utilizing the host-meta document where the authenticity
    of the information is necessary MUST require the use of the HTTPS
    protocol and MUST NOT produce a host-meta document using other means.
    In addition, such applications MUST require that any redirection
    leading to the retrieval of a host-meta document also utilize the
    HTTPS protocol.

I think this strikes a nice balance.

-Evan

---

From: "Paul E. Jones" <[email-masked]>
Date: Tue, 25 Sep 2012 01:41:29 -0400

> prohibit non-TLS connections.

Mike,

The spec currently recommends the use of HTTPS, as did RFC 6415 
(referenced right after the text you highlight).  I do not believe we 
can mandate HTTPS.  There may be private networks that use WebFinger 
that do not need HTTPS.  There will definitely be those who do not want 
to pay for the certificate to protect WebFinger.  We can strongly 
recommend use of HTTPS, but I don't think we can mandate it.

Paul