Subject: [Uta] Barry Leiba's Yes on draft-ietf-uta-xmpp-06: (with COMMENT)

From: "Barry Leiba" <[email-masked]>
Date: Mon, 20 Apr 2015 14:43:13 -0700

Barry Leiba has entered the following ballot position for
draft-ietf-uta-xmpp-06: Yes

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/draft-ietf-uta-xmpp/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

-- Section 3.4 --

   Wherever possible, it is best to prefer authenticated connections
   (along with SASL [RFC4422]), as already stated in the core XMPP
   specification [RFC6120].  In particular, clients MUST authenticate
   servers and servers MUST authenticate clients.

How does "prefer" "whenever possible" match up with "MUST" and "MUST"?

Ah, I see; in the next paragraph, we have server-to-server
authentication, which isn't a MUST.  Got it.  So, purely optional if you
agree with me, but I'd find it less confusing like this:

NEW
   Wherever possible, it is best to prefer authenticated connections
   (along with SASL [RFC4422]), as already stated in the core XMPP
   specification [RFC6120].  In particular:
   
   * Clients MUST authenticate servers.
   * Servers MUST authenticate clients.
   * Servers SHOULD authenticate other servers.

   This document does not mandate that servers need to authenticate
   peer servers, although such authentication is strongly preferred.
   Unfortunately, [...etc...]
END

-- Section 3.6 --

I understand that, while most users won't understand it, there's value in
trying to communicate to an end user that she is using a secure
connection.

I am very skeptical that there's the slightest bit of value in giving end
users information about the version of TLS used, the mechanism for
verification, the details of the certs (if any), or the details of the
cipher suite.  I'm certainly skeptical that making that available to end
users should rise to the level of "strongly encouraged".  I'm not going
to block anything with regard to this, but I see this as something you
might strongly encourage be available to an administrator, but not to an
end user (other than, perhaps, by enabling detailed logging through an
advanced setting, then inspecting the logs).

---

From: Peter Saint-Andre - &yet <[email-masked]>
Date: Mon, 20 Apr 2015 15:57:59 -0600

Hi Barry, thanks for the review. Comments inline.

> http://datatracker.ietf.org/doc/draft-ietf-uta-xmpp/

Yes, that's more readable for sure!

> advanced setting, then inspecting the logs).

At one point in the history of this document, we had separate bullet 
lists for administrators and end users. There was so much overlap that 
it was confusing. However, we might consider bringing that back.

Peter

-- 
Peter Saint-Andre
https://andyet.com/

---

From: Peter Saint-Andre - &yet <[email-masked]>
Date: Mon, 20 Apr 2015 16:27:28 -0600

> On 4/20/15 3:43 PM, Barry Leiba wrote:

<snip/>

> it was confusing. However, we might consider bringing that back.

BTW, we based the user-oriented recommendation somewhat on current 
practices in web browsers. For instance, Firefox has an indicator 
showing whether a connection is encrypted, but also has an advanced 
option that enables a user to view the certificate and also see the TLS 
version and cipher suite (e.g., my connection to datatracker.ietf.org 
uses TLS 1.2 with TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256). I suppose we 
can argue about how useful this information is to a "normal" user, but 
deliberately hobbling XMPP clients in comparison to (some) web browsers 
seems less than completely helpful.

Peter

-- 
Peter Saint-Andre
https://andyet.com/

---

From: Barry Leiba <[email-masked]>
Date: Mon, 20 Apr 2015 18:48:48 -0400

> BTW, we based the user-oriented recommendation somewhat on current practices
> in web browsers. For instance, Firefox has an indicator showing whether a
> connection is encrypted, but also has an advanced option that enables a user
> to view the certificate and also see the TLS version and cipher suite (e.g.,
> my connection to datatracker.ietf.org uses TLS 1.2 with
> TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256). I suppose we can argue about how
> useful this information is to a "normal" user, but deliberately hobbling
> XMPP clients in comparison to (some) web browsers seems less than completely
> helpful.

Ack.
And, of course, my comment is just a minor comment, so you can
absolutely ignore it.

I guess the only thing I would do, if it were my choice, is replace
"strongly encouraged" with something like an explanation such as what
you say above.  Something that says that user-agent software often
provides a way for advanced users (or any users at the direction of an
administrator) to retrieve this extra information for trouble-shooting
purposes, and that having such a mechanism is very useful.

Anyway, again: just $.02, to take it as you will.  And thanks for the response.

Barry