Subject: [weirds] Ted Lemon's Discuss on draft-ietf-weirds-using-http

From: Andy Newton <[email-masked]>
Date: Fri, 22 Aug 2014 19:51:11 +0000

Ted Lemon has a discuss against draft-ietf-weirds-using-http.

It appears to be security related. Does it need to be addressed in draft-ietf-weirds-rdap-sec?

-andy

Here is the Discuss:
—————————————————
This document doesn't talk about security, which sort of makes sense
considering the other weirds document we're reviewing in the same telechat.  
However, I am concerned that there is a gap between the two documents that
leaves open the possibility of password leakage.

Suppose I go to an RDAP server wanting some information that is confidential,
and requires authentication.   Further suppose my request is to an http URL,
not an https URL.

Presumably the RDAP server would tell me I need to authenticate, by sending an
HTTP 401 response.   Suppose basic authentication is being used.   The server
must first redirect me to an https server, which _then_ would send the 401
response.   If the response to the http query is 401, the client may send the
password over the network in the clear, since this is allowed by the HTTP
protocol.

In practice, I would expect that anything that needs to be authenticated is
going to have to go over TLS anyway, so this should be straightforward to
specify.

Possible responses to clear this DISCUSS would be (a) to point out that I am an
idiot and this isn't a problem because I don't understand HTTP authentication
properly (I know only enough to be dangerous, so this is a real possibility);
(b) to argue that this needs to be fixed but should be addressed in the
weirds-rdap-sec document and not in this document, or (c) to add some text to
this document specifying how this should be done.   Currently neither document
explicitly discusses the 401 response code.

---

From: "John Levine" <[email-masked]>
Date: 23 Aug 2014 05:35:23 -0000

>It appears to be security related. Does it need to be addressed in draft-ietf-weirds-rdap-sec?

The weirds draft says nothing about http authentication or any other
security scheme other than to mention that RDAP servers are allowed to
use them.  While it is possible that an RDAP server might use http
authentication, it is also quite possible that it might use IP ACLs
(the most common approach for WHOIS) or SSL client certs, or any other
security scheme that http supports.

If an RDAP server does offer both plain and SSL access, and has some
information only available to users authorized with passwords (all
assumptions way beyond anything the draft says), there's no reason to
assume that a request via plain access for restricted data would
return a 401 code.  More likely it'd return 403 (forbidden), on the
reasonable assumption that anyone who has a password would know to use
SSL access.  None of this has anything to do with RDAP--it's generic
web usage.

If we are expected to provide security advice for every possible
generic http issue, this is going to be a very, very, long document.

R's,
John

>_______________________________________________
>weirds mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/weirds
>

---

From: "Hollenbeck, Scott" <[email-masked]>
Date: Wed, 27 Aug 2014 19:09:55 +0000

> -----Original Message-----
> From: weirds [mailto:[email-masked]] On Behalf Of Andy Newton
> Sent: Friday, August 22, 2014 3:51 PM
> To: [email-masked]
> Subject: [weirds] Ted Lemon's Discuss on draft-ietf-weirds-using-http
> 

It could be, if we agree that there's something we need to address.

Scott