RE: The enc: URL scheme

The technicalities of this proposal may be different and more acceptable than the prior http+aes scheme, but the principle intention appears to remain the same.  Security of addressing is mutually exclusive to the security upon the artifact resolved at the address.  This said it appears that attempts to hide the artifact by making the address unintelligible to sniffing by third parties is only obfuscation, which is not security at all.  What that really means is that if a CDN is untrusted before use of a URI encryption scheme it will continue to be untrusted after use of an encrypted URI scheme and any problems associated with the absence of trust remain unresolved at the frustration of legitimate infrastructure monitoring.  If my security argument is valid then a scheme to encrypt URI is actually harmful to security.  If this is actually harmful to security then it seems the parties that primarily benefit are only untrusted CDNs and media at cost of confidentiality, and likely integrity, to the end user as well as the information service acted upon by that end user.  Confidentiality would be harmed because the originating source remains untrusted and may therefore redistribute information of the connection during or after the connection to unauthorized parties.  Integrity could be harmed because the CDN remains untrusted may therefore transmit a similar artifact embedding tracking data or malicious code outside of any integrity verification, such as hash comparison.

Outside of security concerns that may or may not be valid an encryption scheme upon URI destroys web openness.  When the web is no longer an open platform it will be a less desirable platform compared to proprietary alternatives with better application performance, fewer transmission bottlenecks, and fewer security concerns.

Austin

-----Original Message-----
From: Kornel Lesiński [mailto:kornel@geekhood.net] 
Sent: Thursday, June 14, 2012 4:25 AM
To: uri@w3.org
Subject: The enc: URL scheme


I've proposed a new URL scheme in the public-html list (as a response to http+aes scheme and video encryption discussed there):

http://lists.w3.org/Archives/Public/public-html/2012Jun/0094.html

-- 
regards, Kornel Lesiński

Received on Thursday, 14 June 2012 11:32:13 UTC