Re: [push-api] Technique to Detect Endpoint Prior to register() (#95)

Sorry for late response - vacation.

There are few reasons why 'sender' registration is required in GCM - it may
be possible to allow sending without a registered sender ID in GCM, but it
would be with
a very low quota. I think avoiding the mistakes of SMTP is quite important,
operating a large push service is tricky and it is important to
authorize the senders and do some basic validations.

I would propose an alternative option: use the same protocol to register
senders as clients, which could be automated.

I think everyone agrees that the client will need a key pair,  and UA will
make a request to 'subscribe' to the push provider.
We need to finalize the details of this request - I would assume it will
include at least:
- public key of the app
- origin / package name / extension id
- some signature with the private key to prove ownership
- ID of the device
- some info about the UA ( at least impl & version )
- the public key of the authorized sender

The push service will return the subscription ID ( as URL ), and the URL
for its 'subscribe' endpoint.

The app server will get the subscription ID and 'subscribe' URL, and if it
is an unknown push service it will
make a similar 'subscribe' request as a client, proving that it controls
the public key ( sender public key ).

This model is similar with what is typically done for getting a cert for
HTTPS - except the steps will be automated
and obviously each push service will act as registry for public keys used
by all notes ( clients or servers) using that
service. All work on client will be done by the UA - the app only needs to
include the public key of the server.
The server will need some library similar with the UA - but I don't think
it will be very complicated, and push providers
may provide UI or integration to avoid/simplify this step for senders.

If we do this - it may be possible to operate without an app server -
assuming 2 apps instances can discover each other's
public key.

Costin

On Mon, Jan 12, 2015 at 1:42 AM, Matthew Gaunt <notifications@github.com>
wrote:

> I don't think this is going to move forward / be an issue anyone else is
> concerned about so let's continue moving forward with the spec as is and
> assume that UA sniffing is the best approach moving forward.
>
> —
> Reply to this email directly or view it on GitHub
> <https://github.com/w3c/push-api/issues/95#issuecomment-69546516>.
>

---
Reply to this email directly or view it on GitHub:
https://github.com/w3c/push-api/issues/95#issuecomment-69624776