Re: Protocol Authentication (was Re: Collection convergence?)

[Joe Gregorio <joe.gregorio@xxxxxxxxx>]

On Thu, 17 Mar 2005 17:50:38 -0500, Robert Sayre <mint@xxxxxxxxxxxxxxx> wrote:
> 
> John Panzer wrote:
> 
> > Note that the draft spec doesn't prohibit doing any of this.  It just
> > says that you also have to support Digest Auth, whatever else you do.
> > I'm not sure whether Blogger intends to support the spec once it's
> > finalized; adding Digest to BASIC auth would be pretty easy.  Has anyone
> > asked Jason Shellen?  (CCd).
> 
> Steve and Greg have both posted in the past that they can't and won't
> support Digest. Dare has also objected to the requirement.
> 
> >
> >>>
> >>> I believe we do need a "greatest common denominator" authentication
> >>> specification for interoperability, but could be convinced otherwise.
> >>>
> >>
> >> I wish we could do that, but we can't, IMHO.
> >>
> > OK, that's your opinion; my opinion is the opposite.  You've presented
> > one case (Blogger) that's using something almost compliant with the
> > draft spec, and mentioned a few hypothetical clients that you think
> > won't follow the spec.  I'm still not convinced.  Maybe I'm an incurable
> > optimist.
> 
> I think this is not our layer. The real world will shake out industry
> standard auth schemes pretty quickly, I imagine. Deciding security
> requirements for other people is really tough, IMHO.

+1 We should just state that *if* authentication is required 
    on the server then the implementation should consider the following 
    issues... blah blah no plain text passwords blah blah.

Mandating Digest for the server is problematic for several reasons:

1. How soon until it is no-longer considered as insecure as
    Basic? MD5 is broken and digest itself is already open
    to man in the middle attacks. There is no way to predict
    how quickly an auth scheme will go out of favor, how long
    was SHA-1 supposed to last?

2. It is also problematic in situations where the
    service may not be protected, for example, a wiki.

Now, mandating that a 'client' needs to be able to interact with a
server using Digest is something competely different. That *may* be
a way to increase interopability. It seems that that is the tact
that WebDAV chose, unless I am reading the spec incorrectly:

    http://www.webdav.org/specs/rfc2518.html#rfc.section.17.1

    -joe

-- 
Joe Gregorio        http://bitworking.org