Subject: Re: [ietf-privacy] [new-work] Proposed W3C Charters: Web Application Security WG, Web Security IG (until 2011-08-19)

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 27 Jul 2011 14:14:42 -0400

Hi Ian, 

I am puzzled about the relationship between the recently proposed work on "Do Not Track" in the W3C, which aims to make an improvement in the area of data sharing between websites, and the work chartered for the Web Application Security  group (with respect to Cross-Domain Resource Sharing / Cross-Origin Request Sharing). CORS is a slap in the face of everyone who wants to improve Web privacy since it is a step in the wrong direction with regard of improving user involvement prior to data sharing. (This is the user's consent part that more recent work is heavily focused on.) While one can argue that Adobe Flash is even worse it does not mean that one needs to support the work by standardizing these bad practices (particularly if you want to start privacy related work in another working group).

Ciao
Hannes

On Jul 15, 2011, at 12:50 AM, Ian Jacobs wrote:

> Hello,
> 
> Today W3C Advisory Committee Representatives received a Proposal to revise the Security Activity [0] (see the W3C Process Document description of Activity Proposals [1]). This proposal consists of two new charters:
> 
> Web Application Security Working Group 
> http://www.w3.org/2011/07/appsecwg-charter.html
> 
> Web Security Interest Group
> http://www.w3.org/2011/07/security-ig-charter.html
> 
> As part of ensuring that the community is aware of proposed work at W3C, this draft charter is public during the Advisory Committee review period.
> 
> W3C invites public comments through 2011-08-19 on the proposed charters. Please send comments to [email-masked], which has a public archive:
>  http://lists.w3.org/Archives/Public/public-new-work/
> 
> Other than comments sent in formal responses by W3C Advisory Committee Representatives, W3C cannot guarantee a response to comments. If you work for a W3C Member [2], please coordinate your comments with your Advisory Committee Representative. For example, you may wish to make public comments via this list and have your Advisory Committee Representative refer to it from his or her formal review comments.
> 
> If you should have any questions or need further information, please contact Sandro Hawke, Team Contact <[email-masked]>.
> 
> Thank you,
> 
> Ian Jacobs, Head of W3C Communications
> 
> [0] http://www.w3.org/Security/Activity
> [1]
> http://www.w3.org/2005/10/Process-20051014/activities#ActivityCreation
> [2] http://www.w3.org/Consortium/Member/List
> 
> --
> Ian Jacobs ([email-masked])    http://www.w3.org/People/Jacobs/
> Tel:                                      +1 718 260 9447
> 
> _______________________________________________
> new-work mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/new-work

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 27 Jul 2011 14:20:11 -0400

Huh?

The Web already offers ample capabilities for JS code on origin A to
talk to the server for origin B
(Iframes, JSONP, IMG tags, etc.) CORS is about providing a more
convenient mechanism for
doing it. Calling this capability "a slap in the face of everyone who
wants to improve Web privacy"
is, to put it mildly, overwrought.

-Ekr

On Wed, Jul 27, 2011 at 2:14 PM, Hannes Tschofenig
<[email-masked]> wrote:
> ietf-privacy mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf-privacy
>

---

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 27 Jul 2011 14:44:32 -0400

Hi Ekr, 

There are certainly mechanisms that allow you do share data between different web pages without involving the user. 
You mention a few and there are also other's like Adobe Flash and Silverlight. 
There was a nice overview presentation about this topic at the last IEEE Web 2.0 Security & Privacy workshop: 
http://w2spconf.com/2011/papers/donW2SP11.pptx

I don't think the situation will get any better if the W3C standardizes bad industry practices. 

OAuth and Web SSO solutions have for most parts added a user-authorization interaction to the entire exchange (not only on paper but also in real implementations). 
A CORS approach would be different as it just leaves the user out of the loop. 

I argue that the CORS approach is going in the wrong direction and will make the situation worse; something you try to address in the W3C Do Not Track debate. 
It almost like you create the problems in one W3C working group and try to address them in the other one (most likely with a different group of people in each of the groups). 

Ciao
Hannes

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 27 Jul 2011 15:27:04 -0400

> It almost like you create the problems in one W3C working group and try to address them in the other one (most likely with a different group of people in each of the groups).

Hannes, I must be missing your point.

It's simply the nature of modern web sites to aggregate resources
drawn from multiple sources
(CSS, JS libraries, JS analytics, embedded ads, iframes, etc.). Those
resources are automatically
embedded without the consent of users in a huge number of different
ways and no attempt is
made to prevent information leakage back to the site. The notion that
we should require user
consent before (for instance) loading JQuery or embedding a GIF
strikes me as rather
unrealistic. And yet that is all that is required to enable information leakage.

The restriction that CORS relaxes here is not to allow more
information flow *to* other sites
but to allow information flow back *from* other sites. (You already
had a sufficiently generative
method of sending data to sites by embedding a form element). Given
that anything that can
be done with CORS can already be done, albeit in more annoying ways, I
really don't see
how you can credibly argue that CORS changes the privacy situation in
any significant way.

-Ekr