W3C home > Mailing lists > Public > ietf-http-wg-old@w3.org > May to August 1995

Re: potential security holes in digest authorization

From: John Franks <john@math.nwu.edu>
Date: Mon, 17 Jul 1995 11:53:08 -0500 (CDT)
Message-Id: <199507171653.LAA04403@hopf.math.nwu.edu>
To: Dave Kristol <dmk@allegra.att.com>
Cc: john@math.nwu.edu, http-wg%cuckoo.hpl.hp.com@hplb.hpl.hp.com
According to Dave Kristol:
> John Franks <john@math.nwu.edu> said:
>   [regarding my proposal to embed hostname in the password file line]
>   > This would mean that only one hostname could be used in the URL.  I.e.
>   > even though host.com and www.host.com are the same host, one of the URLs
>   > 
>   > 	http://host.com/secret.doc
>   > and
>   > 	http://www.host.com/secret.doc
>   > 
>   > would have to fail even when the user supplied a valid username/password.
>   > This would be a serious flaw.
> 
> I disagree with the premise.  I wouldn't encode the domain name that
> the user accessed to reach my server.  I would encode the name that the
> server uses for itself, for example the name set by NCSA HTTPD
> ServerName directive.

How is the client supposed to know this?  You'll have to make further
additions to the protocol.  Maybe I am confusing who said what but
didn't you also complain that encoding the hostname would make it
impossible to move the password file to a new host?  This is a good
point and suggests a realm containing the enterprise name, but not the
host name -- something like "group@Enterprise_Name" e.g.
"Engineering@ATT_Bell_Labs".

> 
> Thank you for motivating my second quibble, namely:  I want to be able
> to specify a (user/password) prompt independent of the realm.  I don't
> think much of a realm named "myrealm@www.myplace.com", but maybe I'm
> perverse.  I prefer
> 	Enter username for [prompt that I specify] at www.research.att.com:
> to
> 	Enter username for myrealm@www.myplace.com at www.myplace.com
> 
> Evidently (sigh) I'm the only person in the world who feels this way.
> 

The prompt displayed is entirely up to the browser.  Different
browsers will do it differently with different kinds of dialog boxes.
They seem to all display the realm.  If you want to get them all to
agree to let the server supply the prompt you have a tough task.

There may also be security issues since I could display a prompt 
concealing the fact that I am using a realm identical to someone elses.
Displaying a prompt and a realm would be too much.

This discussion has highlighted the importance of displaying the
realm and users not entering a password unless the realm agrees with
enterprise they are accessing!

John Franks
Received on Monday, 17 July 1995 09:54:21 EDT

This archive was generated by hypermail pre-2.1.9 : Wednesday, 24 September 2003 06:31:23 EDT