Subject: Re: [Webpush] CALL FOR CONSENSUS: VAPID cut-and-paste protection

From: Phil Sorber <[email-masked]>
Date: Sat, 02 Sep 2017 03:02:53 +0000

I think that we have consensus on this. Other options were considered by
the working group but for various reasons, such as deployment complexity,
were ruled out in favor of the JWT bearer token, despite it's sub-optimal
security properties.

Thanks everyone for the feedback.

On Thu, Aug 17, 2017 at 10:17 PM Martin Thomson <[email-masked]>
wrote:

> On 18 August 2017 at 12:58, Phil Sorber <[email-masked]> wrote:
> > I believe the working group has already discussed adding such a mechanism
> > and rejected it (with citation to an email discussion or minutes
> reflecting
> > such discussion).
>
> We did consider options that don't have this unfortunate property.
> Client certificates were a strong contender.  They would have been
> ideal if not for operational challenges.
>
> Here's the email that I think was pivotal on this subject:
> https://mailarchive.ietf.org/arch/msg/webpush/_qwcGCuDekERw5o31t0MjFJGTh8
>
> Later there is also:
> https://mailarchive.ietf.org/arch/msg/webpush/poGnqtBFlFe3hpzvkiS3Rp5L94g
>
> There are yet more emails that follow on from this where we discuss
> scope of the token and relative costs.  The first of those is here:
> https://mailarchive.ietf.org/arch/msg/webpush/xrqo-LUb7mrPV6eF1xgyJoqMgCU
>
> I found the rest of thread instructive as a reminder of what happened,
> I had forgotten the details of this discussion.
>
> I didn't read meeting minutes, the above seems sufficient.
>

---

From: Martin Thomson <[email-masked]>
Date: Mon, 4 Sep 2017 10:02:19 +1000

New drafts pushed.  Hopefully the IESG is happier this time around :)

On Sat, Sep 2, 2017 at 1:02 PM, Phil Sorber <[email-masked]> wrote:
> I think that we have consensus on this. Other options were considered by the
> working group but for various reasons, such as deployment complexity, were
> ruled out in favor of the JWT bearer token, despite it's sub-optimal
> security properties.
>
> _______________________________________________
> Webpush mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/webpush
>