PaceSecurityServices

[Joe Gregorio <joe.gregorio@xxxxxxxxx>]

There is too much in this one Pace to just +1 or -1
the whole thing.

In the section on the AtomAPI:
---------------------------------------------

+1 on Digest and TLS

I support referencing and strongly encouraging
the use of standard authentication and 
encryption mechanisms.

-1 to WSSE

On the other hand I do not like the WSSE
mechanism ( wide open to man in the middle
attacks and requires both the client and the
server to store plaintext passwords ). 
If we must create a new authentication mechanism 
I would prefer to use an updated version of [1] that supports
multiple kinds of hashes and mandates 'auth-int'. 
This will provide better security to implementors, 
easier implementations for systems that already store
hashed values of passwords, and provides protection
against man in the middle attacks.

If we must create a new authentication mechanism
than I would also like it to be a seperate RFC from the
the AtomAPI, just as HTTP is broken into 
RFC 2616 and 2617.

[1] http://bitworking.org/news/New_AtomAPI_Implementation_Release2