Subject: [http-auth] HTTP Auth Next BOF at IETF Prague deadline Monday/Possible W3C Workshop?

From: "Harry Halpin" <[email-masked]>
Date: Sun, 30 Jan 2011 19:07:49 -0000 (GMT)

Everyone,

  I have been impressed with the discussion so far here - although it has
died down recently. There seems to me to be no giant technical holes in
mutual-auth, and almost anything would be better than current HTTP Auth
Basic.

The way I see it is that there seems to two problems:

1) Login forms in HTML are by nature insecure, and the resulting cookie
can be hijacked.

2) But Web developers are unwilling to let browser chrome take over
log-in, and cookie/security management in the browser is uneven at best.

The solution that gives us some security while letting Web developers
still control login UI. My feeling is that this may very well be some form
of allowing the authorization done in the browser via some kind of secure
form/javascript, but I believe this is an open research question. Links to
information would be appreciate.

The problem must be tackled ASAP and it cannot be impossible. We may just
need some more people in the room. The W3C has recently taken a keen
interest in this area, and would be happy to organize a workshop on this
theme to see if browser vendors and the WebApps/HTML5 WG are interested.
I'm happy to take the lead on organizing such a workshop somewhere near
the browser vendors ASAP. That can help us mange problem 2).

However, the relevant issues about HTTP Auth and a draft design (I'm happy
to start with MutualAuth, but very open) need to be sorted ASAP to get a
tech design to overcome 1), and a proposal from the IETF on the table
would definitely help get the attention I think of browser folks and
Webapp developers.

Would people be up for a HTTP Auth BOF at the next IETF meeting in Prague?
The deadline for BOF requests is Monday [1]. I and others from the W3C
will be there.  If the HTTP Auth BOF has already happened too many times,
let's call it WebAuth, and be specific about the browser/javascript aspect
and looking at new solutions. Anyone else up for this?

If so, who wants to request the BOF? Request should be done today/tomorrow.

[1] http://www.ietf.org/meeting/cutoff-dates-2011.html#IETF80

         cheers,
           harry

---

From: Yutaka OIWA <[email-masked]>
Date: Mon, 31 Jan 2011 17:20:31 +0900

Dear Harry,

# I've just arrived to Tokyo/Narita from Austin and writing in the airport.

+1 ... I really like to have a meeting at Prague!
I already sent Peter a mail personally, but not in a IETF-formal way.
I do not have enough expertise on the IETF procedures and helps from experts are
really needed.  But if no one else is appropriate, I would be able to take a role.

I think HTTP-auth have nothing in the past to block new activities in the IETF.

On 2011/01/31 4:07, Harry Halpin wrote:
> _______________________________________________
> http-auth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/http-auth

-- 
Yutaka OIWA, Ph.D.                                       Research Scientist
                            Research Center for Information Security (RCIS)
    National Institute of Advanced Industrial Science and Technology (AIST)
                      Mail addresses: <[email-masked]>, <[email-masked]>
OpenPGP: id[440546B5] fp[7C9F 723A 7559 3246 229D  3139 8677 9BD2 4405 46B5]

---

From: "Harry Halpin" <[email-masked]>
Date: Mon, 31 Jan 2011 10:45:12 -0000 (GMT)

> really needed.  But if no one else is appropriate, I would be able to take

Another idea would be to hold an informal bar-BOF at Prague if the BOF
can't be put together quickly enough as a bar-BOF would require less work
and give us more time to bake the tech ideas or charter. I'll leave this
decision in the hands of more experienced IETF folks.

I'll push things hard to get a W3C workshop together ASAP, and a
double-combo of an IETF and W3C effort sounds promising to me. Following
the conversaton on the list, I'm still unclear on the next _exact_ tech
steps, but I think its straightforward that HTTP Auth needs fixing and
that the browsers will eventually in the long-term play a role, so we need
to start outreach and organization ASAP.

---

From: Yutaka OIWA <[email-masked]>
Date: Mon, 31 Jan 2011 20:54:37 +0900

Dear Harry and all,

> decision in the hands of more experienced IETF folks.

In both ways, anyway, we will need a good-direction proposal and
agenda.  It is hard for me to write a "good" one, but I made a "bad" :-)
one as a starting point.

Please consider it for improvements and rephrasing.  Thanks Harry for
providing a very good descriptions which I've used as a staring point.

 * Things to consider:

   - agenda not yet written
   - goal: currently ambiguous (intentionally); to discuss, or to form WG?

--------
Description:

The current authentication methods used in the Web system is prone to
various serious vulnerabilities, including password eavesdropping,
password stealing, session hijack, and phishing.  Because of the lack
of a good/secure support for web application authentication in the
HTTP layer, people tends to use HTML forms for authentication, which
are by nature insecure.

This problem should be solved as soon as possible to mitigate the
impact of Web authentication-related frauds to the Internet
users. However, to solve this problem, the resulting technologies
should be carefully designed so that these will be well deployable to
the real-world applications.

Recently we have several new proposals for securing Web/HTTP
authentications, some of which has a proposed drafts.  In addition,
the work of the HTTPBIS working group is about to finish, and it will
require some maintenance works for the HTTP existing authentication
mechanism, at least the registrations to IANA.

The purpose of the proposed BoF is to pursue creation of IETF working
groups on various HTTP authentication issues.  The possible topics of
the future working group may include the following topics:

 * Introduction of much more secure authentication mechanisms as
   extensions to the HTTP.

 * Introduction of technologies which will enable more sophisticated
   use of HTTP authentication in application layer.

 * Research on the secure ways of Web/HTML authentications and
   required protocol-side support for them

 * Maintenance of existing HTTP authentication extensions (other than
   Basic and Digest), either checking its httpbis-conforming or making
   it historic.

 * Proposing addition of authentication schemes to the IANA registry
   as proposed by httpbis.

Both BoF and possible future working group expect well coordination with
W3C's effort on the related topics.

BoF proposed agenda:

 * Topics to be discussed in the future working group

 * TBD

Logistical informations:

BoF Chairs: TBD
BOF Proponents: Harry Halpin, Yutaka OIWA, ... (TBD)
People expected: 50
Length of session: 90min
Conflicts to avoid: Working Groups in the APP and SEC areas
WebEX: no
Responsible AD: Peter Saint-Andre, Alexey Melnikov (tentative)
Goal: to pursue creation of IETF working groups
Drafts:  http://tools.ietf.org/html/draft-oiwa-http-mutualauth-08; more to be discussed
Mailing List: HTTP http-auth mailing list
Mailing List Archive: http://www.ietf.org/mail-archive/web/http-auth/
--------

---

From: Peter Saint-Andre <[email-masked]>
Date: Mon, 31 Jan 2011 10:42:47 -0700

> decision in the hands of more experienced IETF folks.

I think that a "bar bof" / informal side meeting at the Prague IETF
meeting makes the most sense, followed by focused discussions on this
list and then a WG-forming BoF at IETF 81 (if we think that's needed).

I say that because I don't think we're quite ready to form a working
group, but we have important technical topics to discuss. We could hold
a non-WG-forming BoF ("exploratory BoF") but an informal side meeting
might be less pressured and therefore more productive -- in my
experience it's best to hold a BoF when you have a strong proposal about
forming a WG.

Peter

--
Peter Saint-Andre
https://stpeter.im/

---

From: Peter Saint-Andre <[email-masked]>
Date: Mon, 31 Jan 2011 11:35:15 -0700

Hi Yutaka, thanks for the strawman! This is a good start, and I would
like to see some discussion of it on the list leading up to IETF 80.

---

From: Yutaka OIWA <[email-masked]>
Date: Tue, 01 Feb 2011 08:43:17 +0900

Dear all

I agree that we need more to make focus on the topics to be discussed
in the future working group.

# Honestly speaking I feel a little sad this moment, but I have to
# agree that haste is from the devil.

By the way, I listed up some possible topics in the previous mail.  In
last few months people, "including me", were very active in discussing
their own ideas of securing the Web, and it was very interesting.
However, at this moment, for each "proposal" we need to figure out how
it can be implemented in the real world seamlessly, how it can be
implemented as a protocol specification in RFC, whether it can be a
IETF topic or have to be discussed in more wider people, and many
others.  We also have to take care of how the collaborations should
take part with other working groups (such as OAUTH, and ABFAB),
especially for the federation-based and protocol-stack-based (such as
using SASL in Web) solutions.  That is one of the reasons that I wrote
some of the topics in a very abstract way, such as "Research on the
secure ways of Web/HTML authentications and required protocol-side
support for them".  If you have some concrete ideas for securing Web,
your feedbacks on the proposed topics list are really really needed.
I would be able to add it to the list of possible topics then.

And of course, if you have any good idea I really love to see an
Internet-draft on it so that we can understand it more deeply and
start discussion on it.

All Regards,

Yutaka

---

From: "Harry Halpin" <[email-masked]>
Date: Tue, 1 Feb 2011 00:23:22 -0000 (GMT)

> Internet-draft on it so that we can understand it more deeply and

I think MutualAuth is a good starting place, although the issue of browser
chrome is still worrisome and a major halting point. As HTTP Auth is
obviously broken in its current state, the ideal situation would be
something more or less like MutualAuth from the protocol side combined
with broader based effort on the client-side to go after "low-hanging
fruit" here - i.e. cookie management, ID management, SSL/certs, Javascript
security (OK, that one is tough), APIs to make it easier to deploy and try
to get a unified user-experience on authorisation across various clients.
It's all easy enough to say, but will require a real effort to get done.

It's ambitious, I admit - but after the situation in Tunisia in particular
where there was a massive man-in-the-middle attack against more or less
the entire population! - I think the time is right even if the exact
technical solution is not completely clear right now. I'm sure we have
enough collective intelligence between the IETF and other concerned
parties to make something real, and I think current events may increase
both user concern and implementer desire to get things actually in users
hands.