Subject: [lemonade] Channel questions

From: "Vaudreuil, Greg M (Greg)" <[email-masked]>
Date: Tue, 10 Feb 2004 09:11:22 -0600

Having recently reviewed the URLauth document, I am curious why we don't use that mechanism to authenticate the channel extension?

I see the channel extension has the same security problems as the IMAP PULL scheme, that is, the URL established by the IMAP server can be guessed, or snooped and re-fetched.  Is there something I am missing that makes the risk model different for Channel?

Also, the security considerations sections needs to be substantially beefed up.

In the current scheme, I would suggest discussion on at least the following points:

- Don't use a predictable namespace for the URL's.  Seems simple, but don't make URL's for message contents that are world-readable with identifiers based on message-id and/or body structure.

- Make URL's available for a limited time window only.  In fact, it would be best if the URL went "poof" after being accessed the first time. 

- Don't assume the channel client is in the same security zone as the the IMAP server.  I see this as an Internet service.  It may be too easy for an implementer to assume that the phone client, for example, is always on the same LAN segment, firewalled from the rest of the world.  Deploying that implmentation elsewhere would be an open invitation.

Greg V.

_______________________________________________
lemonade mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/lemonade