Token Binding - Revision history

Tom: /* Problem */

2021-11-06T00:05:59Z

‎Problem

2020-12-08T17:45:58Z

‎Problem

2018-11-14T00:19:19Z

‎Solution

2018-11-14T00:16:56Z

‎Problem

2018-11-13T22:12:25Z

‎Problem

2018-11-13T22:11:51Z

‎Problem

2018-11-13T21:58:27Z

‎Context

2018-11-13T21:57:05Z

‎Problem

2018-11-13T21:55:42Z

‎Context

2018-11-13T21:54:55Z

‎Solution

@@ Line 11: / Line 11: @@
 *HTTPS and the identity in the [[X.509]] Certificate is adequate given the uncertain nature of the [[URL]] as an [[Identifier]].
 * Token binding requires that the key used in TLS be used at the application layer. That would require that the internet facing server have access to the signing key, or at least that the signing key be distributed to multiple servers. This is poor security practice and should be banned outright.
 ==Solution==

@@ Line 10: / Line 10: @@
 *Token reuse: [[OAuth 2.0]] or [[OpenID Connect]] use of bearer tokens raises the risk of token theft. For years architects have been waiting for Token Binding to get ratified so there would be a transparent mechanism to close this gap. RFC 8471 ''The Token Binding Protocol Version 1.0'' was approved in (2018-10) by the IETF. The [[Token Binding]] feature has been dropped by the Google Chrome browser as inadequate to solve the problem at about the same time as the RFC was approved. So a different solution is required.
 *HTTPS and the identity in the [[X.509]] Certificate is adequate given the uncertain nature of the [[URL]] as an [[Identifier]].
 ==Solution==

@@ Line 13: / Line 13: @@
 ==Solution==
 Look to other solutions like:
-# [[Bound Token]]s
+# [[Bound Token]]s do not need to be based on the underlying HTTPS connection, which was never designed to create trust in the identity of the [[Web Site]].
-# trusted URIs.
+# Create a [[Trusted Identifier]] as a URN for web sites and then bind the token to that URN.
 ==Reference==

@@ Line 9: / Line 9: @@
 *Attempts to make a trusted connection from a user to [[Web Site]] have included [[EV Cert]]s and other attempt to over come the failings inherent in trusting any connection based on the [[URL]] have all failed. See the page [[Bearer Tokens Considered Harmful]] for details.
 *Token reuse: [[OAuth 2.0]] or [[OpenID Connect]] use of bearer tokens raises the risk of token theft. For years architects have been waiting for Token Binding to get ratified so there would be a transparent mechanism to close this gap. RFC 8471 ''The Token Binding Protocol Version 1.0'' was approved in (2018-10) by the IETF. The [[Token Binding]] feature has been dropped by the Google Chrome browser as inadequate to solve the problem at about the same time as the RFC was approved. So a different solution is required.
 ==Solution==

@@ Line 8: / Line 8: @@
 ==Problem==
 *Attempts to make a trusted connection from a user to [[Web Site]] have included [[EV Cert]]s and other attempt to over come the failings inherent in trusting any connection based on the [[URL]] have all failed. See the page [[Bearer Tokens Considered Harmful]] for details.
-*Token reuse: [[OAuth 2.0]] or [[OpenID Connect]] use of bearer tokens raises the risk of token theft. For years architects have been waiting for Token Binding to get ratified so there would be a transparent mechanism to close this gap. RFC 8471 was approved in (2018-10) by the IETF. The [[Token Binding]] feature has been dropped by the Google Chrome browser as inadequate to solve the problem at about the same time as the RFC was approved. So a different solution is required.
+*Token reuse: [[OAuth 2.0]] or [[OpenID Connect]] use of bearer tokens raises the risk of token theft. For years architects have been waiting for Token Binding to get ratified so there would be a transparent mechanism to close this gap. RFC 8471 ''The Token Binding Protocol Version 1.0'' was approved in (2018-10) by the IETF. The [[Token Binding]] feature has been dropped by the Google Chrome browser as inadequate to solve the problem at about the same time as the RFC was approved. So a different solution is required.
 ==Solution==

@@ Line 4: / Line 4: @@
 ==Context==
 *Secure web connections are dependent on HTTPS for security.
-*See the page on [[Channel Binding]] about RFC 5056 for details on the context.
+*See the page on [[Channel Binding]] about RFC 5056 for details on the use of low level security protocols to provide application level security.
 ==Problem==