- From: Nicholas Hurley <hurley@todesschaf.org>
- Date: Fri, 31 Oct 2014 10:37:31 -0700
- To: Martin Thomson <martin.thomson@gmail.com>, Robert Collins <robertc@robertcollins.net>
- Cc: Erik Nygren <erik@nygren.org>, "ietf-http-wg@w3.org Group" <ietf-http-wg@w3.org>
On Fri, Oct 31, 2014, at 10:24, Martin Thomson wrote: > On 30 October 2014 19:35, Robert Collins <robertc@robertcollins.net> > wrote: > > Also wouldn't it deliver a trivial downgrade attack to folk who can > > intercept and alter traffic? > > > This is already the case. Hence this being opportunistic. Actually, it is not necessarily already the case. It is true that, if you get an Alt-Svc header over an http-schemed connection, yes, this is already opportunistic. It also doesn't (in that case) deliver a downgrade attack, since you can't really downgrade from anything non-TLS :) In this case, having a noauth token is a no-op, and thus just a waste of bytes. If, however, you get an Alt-Svc header over an https-schemed http/1.1 connection (or an ALTSVC frame on an h2 connection), those will not enable opportunistic encryption, as that *would* present a downgrade attack for a MITM. In this case, having a noauth token to explicitly enable a downgrade attack sounds like a bad idea. Thus, I'm -1 on a noauth token. -- Peace, -Nick
Received on Friday, 31 October 2014 17:37:54 UTC