19:56:42 <RRSAgent> RRSAgent has joined #webappsec
19:56:42 <RRSAgent> logging to http://www.w3.org/2013/02/26-webappsec-irc
19:56:52 <bhill2> rrsagent, draft minutes
19:56:52 <RRSAgent> I have made the request to generate http://www.w3.org/2013/02/26-webappsec-minutes.html bhill2
19:57:38 <bhill2> rrsagent, set logs public-visible
21:42:35 <jeffh> test
21:46:21 <jimio> jimio has joined #webappsec
21:48:10 <bhill2> hi, jeff
21:52:04 <jeffh> hey
21:53:54 <gmaone> gmaone has joined #webappsec
21:56:18 <bhill> bhill has left #webappsec
21:57:24 <Zakim> Zakim has joined #webappsec
21:57:41 <bhill2> zakim, this will be 92794
21:57:42 <Zakim> ok, bhill2; I see SEC_WASWG()5:00PM scheduled to start in 3 minutes
21:57:42 <Zakim> SEC_WASWG()5:00PM has now started
21:57:49 <Zakim> +[GVoice]
21:57:58 <Zakim> -[GVoice]
21:57:59 <Zakim> SEC_WASWG()5:00PM has ended
21:57:59 <Zakim> Attendees were [GVoice]
21:58:21 <Zakim> SEC_WASWG()5:00PM has now started
21:58:23 <bhill2> zakim, this is 92794
21:58:23 <Zakim> bhill2, this was already SEC_WASWG()5:00PM
21:58:24 <Zakim> ok, bhill2; that matches SEC_WASWG()5:00PM
21:58:28 <Zakim> +??P0
21:58:33 <Zakim> +bhill
21:58:50 <bhill2> Meeting: WebAppSec WG Teleconference, Tuesday, 26-Feb-2013
21:58:54 <bhill2> Chairs: ekr, bhill2
21:58:54 <Zakim> + +1.866.317.aaaa
21:58:59 <gmaone> zakim, ??p0 is gmaone
21:58:59 <Zakim> +gmaone; got it
21:59:15 <jeffh> zakim, aaaa is JeffH (i think)
21:59:15 <Zakim> I don't understand 'aaaa is JeffH (i think)', jeffh
21:59:16 <bhill2> Agenda: http://lists.w3.org/Archives/Public/public-webappsec/2013Feb/0066.html
21:59:20 <jeffh> lol
21:59:34 <jeffh> zakim, aaaa is JeffH
21:59:34 <Zakim> +JeffH; got it
21:59:39 <jeffh> i hope so, zakim
21:59:59 <neil> neil has joined #webappsec
22:00:18 <Zakim> +[GVoice]
22:00:40 <jimio> zakim, GVoice is jimio
22:00:40 <Zakim> +jimio; got it
22:00:58 <Zakim> + +1.415.426.aabb
22:01:09 <dveditz> dveditz has joined #webappsec
22:01:20 <Zakim> + +1.650.678.aacc
22:01:32 <jimio> (mostly listening in while on mute today, neil & nick from twitter here too)
22:01:34 <neil> zakim, aabb is neil
22:01:34 <Zakim> +neil; got it
22:01:53 <Zakim> + +1.650.488.aadd
22:02:02 <mkwst_> zakim, aadd is mkwst
22:02:02 <Zakim> +mkwst; got it
22:02:09 <bhill2> zakim, who is here?
22:02:09 <Zakim> On the phone I see gmaone, bhill, JeffH, jimio, neil, +1.650.678.aacc, mkwst
22:02:12 <Zakim> On IRC I see dveditz, neil, Zakim, gmaone, jimio, RRSAgent, bhill2, jeffh, timeless, mkwst_, wseltzer, erlend, trackbot
22:02:12 <Zakim> +[IPcaller]
22:02:24 <Zakim> +[Mozilla]
22:02:28 <dveditz> Zakim, IPCaller is dveditz
22:02:28 <Zakim> +dveditz; got it
22:02:40 <ekr> ekr has joined #webappsec
22:02:44 <ekr> zakim, who is herE?
22:02:44 <Zakim> On the phone I see gmaone, bhill, JeffH, jimio, neil, +1.650.678.aacc, mkwst, dveditz, [Mozilla]
22:02:47 <Zakim> On IRC I see ekr, dveditz, neil, Zakim, gmaone, jimio, RRSAgent, bhill2, jeffh, timeless, mkwst_, wseltzer, erlend, trackbot
22:02:51 <ekr> zakim, aacc is ekr
22:02:51 <Zakim> +ekr; got it
22:03:08 <tanvi> tanvi has joined #webappsec
22:03:12 <tanvi> Zakim, who is here?
22:03:13 <Zakim> On the phone I see gmaone, bhill, JeffH, jimio, neil, ekr, mkwst, dveditz, [Mozilla]
22:03:14 <imelven2> imelven2 has joined #webappsec
22:03:15 <Zakim> On IRC I see tanvi, ekr, dveditz, neil, Zakim, gmaone, jimio, RRSAgent, bhill2, jeffh, timeless, mkwst_, wseltzer, erlend, trackbot
22:03:27 <tanvi> Zakim, tanvi is tanvi_and_imelven
22:03:27 <Zakim> sorry, tanvi, I do not recognize a party named 'tanvi'
22:03:48 <bhill2> http://lists.w3.org/Archives/Public/public-webappsec/2013Feb/0066.html
22:04:21 <Zakim> +[Microsoft]
22:04:25 <bhill2> scribe: Jeff Hodges
22:04:27 <jimio> sorry, I'm on mute
22:04:29 <bhill2> scribenick: jeffh
22:04:32 <jimio> need to leave early (this is jim)
22:04:37 <jeffh> alrightie
22:04:57 <jeffh> joining us: Dave Ross, Microsoft
22:06:12 <bhill2> http://www.surveymonkey.com/s/NXSTXNN
22:06:48 <jeffh> Brad solicits input on how WG is working, via the survey at the above link
22:07:16 <jeffh> webappsec concall in 2 weeks conflicts with ietf HTTP auth WG session at IETF-86 Orlando
22:07:32 <jeffh> hence cancelling webappsec meeting in 2 weeks
22:07:54 <jeffh> Charter update is underway
22:08:06 <jeffh> hopefully done before F2F in April
22:08:15 <bhill2> https://www.w3.org/2011/webappsec/track/actions/open?sort=owner
22:08:18 <jeffh> now look at open actions in tracker
22:09:16 <jeffh> ABarth not present
22:09:21 <jeffh> next victim: Brad
22:09:52 <Zakim> + +1.415.596.aaee
22:09:54 <jeffh> will attempt to chip away at his open action items
22:10:36 <Zakim> + +1.650.648.aaff
22:10:38 <jeffh> Dan Veditz: have sent msg on #82
22:10:52 <jeffh> s/#82/#92/
22:10:58 <jeffh> issue #32
22:11:04 <jeffh> they can be closed
22:11:10 <abarth> abarth has joined #webappsec
22:11:16 <jeffh> #97 and #109 still in todo queue
22:11:29 <bhill2> https://www.w3.org/2011/webappsec/track/actions/open?sort=owner
22:11:37 <jeffh> abarth has arrived
22:12:02 <n_> n_ has joined #webappsec
22:12:13 <puhley> puhley has joined #webappsec
22:12:43 <jeffh> MWest next:  #94 believes is done;  #102 working on it, lang wrt events, still looking for an example(s) -- events being specified in some 2ndary spec -- tug his sleeve if anyone has any ideas
22:13:01 <jeffh> bhill: ui safety spec may have an example
22:13:12 <jeffh> mwest: attrs are easy, but there's other issues
22:13:58 <jeffh> mwest: #106, has text coming soon;  #116 open; #117 ?;   #119 done?
22:14:24 <jeffh> above is correct?
22:14:28 <mkwst_> yup
22:14:30 <jeffh> thx
22:14:40 <bhill2> http://lists.w3.org/Archives/Public/public-webappsec/2013Feb/0052.html
22:14:52 <bhill2> Topic: Script-Hash Proposal
22:15:17 <jeffh> "Proposal for script-hash directive in CSP 1.1"
22:15:38 <jeffh> Nicholas Green
22:15:50 <jeffh> n_ ?
22:16:17 <dveditz> question: is script-hash a replacement for script-nonce, or a separate concept/directive?
22:16:47 <jeffh> abarth: is there particular reason chose utf-8
22:16:48 <jeffh> ?
22:17:03 <jeffh> what about ?
22:17:25 <jeffh> nick: got input on that, devs said don't do it, they prefer utf-8
22:17:34 <jeffh> abarth: what is the alt you mentioned?
22:17:46 <dveditz> UCS-2
22:17:49 <jeffh> thx
22:19:09 <jeffh> bhill: there's an issue in that utf-8 apparently isn't all that friendly for some existing content out there in asian encodings
22:19:29 <jeffh> bhill: this is for inline script
22:19:48 <jeffh> dveditz: inline script will be in encoding the doc is in
22:20:07 <jeffh> bhill: but doc can change encoding mid-stream -- worry about bugs and perf overhead
22:20:40 <jeffh> bhill: so, if you want ur content to be stable enough to be hashed for sec purposes, need to declare doc encoding at top of doc
22:20:52 <jeffh> ekr: what about hash alg?
22:21:20 <jeffh> ekr: <can't parse>
22:21:46 <jeffh> ekr: collisions seem like a irrelvant (?) threat model here
22:22:03 <jeffh> ekr: prob with sha-1 is it isn't as strong as other choices
22:22:37 <jeffh> ekr: sha-256 (sha-180?) is stronger than sha-1
22:23:17 <jeffh> bhill: we should ref the algs in xml-sec or web-crypto, and we don't have to define 'em -- we just do parsing and such
22:23:44 <jeffh> ekr: am fine with that, but there's still the question wrt agility -- can u use two different(?) ones concurently?
22:23:56 <ekr> what I was suggesting here is that you should be able to have two hash algorithms at once. that allows transitions.
22:24:33 <jeffh> bhill: we should require alg agility, allow same content to be specified with mult hases, but which hashes we support should be defined by ref to another spec most likely web-crypto
22:25:47 <jeffh> bhill: is suggesting that can attach mult hashes via diff algs to one content doc, and so if UA understands at least one of them, can verify it
22:26:09 <jeffh> dveditz: what is UA behavior if encounters a hash it doesn't understand?
22:26:35 <jeffh> nick: hunch is script-hash would take precedence over unsafe-inline
22:27:03 <jeffh> nick: would have bkwards compat this way
22:27:12 <jeffh> bhill: need text for that
22:28:28 <jeffh> mwest: does each script loaded on page need to match all csp directives that might possibly apply
22:29:12 <jeffh> tanvi: instead of having unsafe-inline, can have nonce-inline/hash-inline, and so server side could have some way to figure out UA capabilities and adapt what it sends
22:30:26 <jeffh> nick/tanvi:  the goal is to get the best protection on new browsers and least likelyhood of breaking old browsers;   so if have unsafe-inline, ignore it if theres script-hash present
22:31:19 <jeffh> mwest: if both script-hash and script-src are present they have to match?
22:32:00 <jeffh> nick: might make more sense to say if script-hash is present, ignore unsafe-inline (?)
22:32:20 <jeffh> abarth:  there's a lot of overlap in use case in script-nonce and script-hash -- should we do one or not other?
22:33:29 <jeffh> tanvi: was thinking about a case where might want both of themn.  if page had inline scirpt, may want script-hash, and if you're also sucking script over the net, use script-nonce for that; but most ads now are in iframes and so aren't using script@src, so maybe not a big deal
22:33:46 <jeffh> ekr:  script-mac ?   like using a fixed key ?
22:33:54 <ekr> jeffh: yeah.
22:34:00 <ekr> So script-mac with a fixed-key is script-hash
22:34:08 <ekr> script-mac with a null algorithm is script-nonce
22:34:11 <jeffh> nick: CDNs are a use case --
22:34:28 <jeffh> dveditz:  you're trying to protect against 3d party changes?
22:34:38 <jeffh> nick: no, just want to restrict inline script and style
22:35:16 <jeffh> nick: we serve some of our static assets off of cdn, and don't want to re-calc nonce for each request
22:35:55 <jeffh> nick: when told mobile team they need to make their script loaded not inline, they said no cuz of roundtrip
22:36:13 <jeffh> mwest: page and static assets via cdn?
22:36:17 <jeffh> nick: often both
22:36:33 <dveditz> I don’t see the gain of a hash for inline script
22:37:04 <dveditz> (over script-nonce)
22:37:13 <jeffh> mwest: like idea of combining these some way, might be a way to combine them;  bundle this up in some way with script-src ?
22:37:29 <ekr> I had assumed that script-hash was mostly for external scripts
22:37:43 <dveditz> I see the use of hashing for content integrity of 3rd party resources, but that seems it could be an “HTML” feature rather than a CSP feature
22:37:50 <jeffh> abarth: use case of main page mostly on cdn is interesting, will think about
22:37:58 <ekr> Note that for third-party resources, collisions are a clear problem
22:38:31 <dveditz> how so?
22:39:06 <dveditz> you mean a 3rd party will swap content with malicious stuff with the same hash?
22:39:11 <ekr> dveditz: yes
22:39:41 <jeffh> bhill: another item is perhaps using the url-safe base64 encoding
22:40:17 <jeffh> abarth: another issue: if u apply the hash to external resources, u can use this to do "identity queries" on resources you otherwise aren't allowed to read
22:41:12 <jeffh> bhill: let's note this down as an issue
22:41:45 <ekr> issue: same-origin policy identity query via script-hash. issue is you do a third party inline script with a known script-hash. if it succeeds, you know that the target was as expected, even though you can't read it
22:41:45 <trackbot> Created ISSUE-44 - Same-origin policy identity query via script-hash. issue is you do a third party inline script with a known script-hash. if it succeeds, you know that the target was as expected, even though you can't read it; please complete additional details at <http://www.w3.org/2011/webappsec/track/issues/44/edit>.
22:41:47 <jeffh> ?: perhaps requiring CORS will mitigate this
22:42:11 <bhill2> http://lists.w3.org/Archives/Public/public-webappsec/2013Feb/0065.html
22:42:16 <jeffh> bhill: Dave Ross comments on UI Security draft
22:42:25 <bhill2> Topic: David Ross comments on UI Security draft, re: X-Frame-Options
22:44:06 <jeffh> DaveR:  first was wrt framebusting JS -- issue there is ....
22:44:21 <Zakim> + +1.781.369.aagg
22:44:27 <jeffh> bhill: if you have FB code, and then stuff it in a URL the xss filters will clobber FB stuff for u
22:44:58 <jeffh> bhill: some of the interesting issues is whether we consider x-frame-options to be obsoleted by ui safety spec;
22:45:27 <jeffh> bhill: had been assuming one might deploy both for a while, then deprecate x-frame-options;
22:45:50 <jeffh> daver: if x-frame-options is there and ui-safety isn't, then use the former;
22:46:14 <gopal> gopal has joined #webappsec
22:46:15 <bhill2> action bhill2 to remove obsolete language for XFO in UI Security draft
22:46:15 <trackbot> Created ACTION-122 - Remove obsolete language for XFO in UI Security draft [on Brad Hill - due 2013-03-05].
22:46:24 <jeffh> daver:  don't think it makes sense for the doc at this time to explicitly obsolete x-frame-options;  maybe in 10 yrs
22:46:58 <jeffh> daver:  doc sez "if u understand safety, you can ignore x-frame-options", but it is sorta contradicted later on in the spec
22:47:22 <jeffh> bhill:  that item is specifically for "accessibility" considerations
22:48:08 <jeffh> bhill:  that latter stmt specifically gives the accessibility tool author room to work
22:48:32 <bhill2> http://lists.w3.org/Archives/Public/public-webappsec/2013Feb/0062.html
22:48:45 <jeffh> daver:  ok, don't have suggestion for alt text on that, so thinks its probably fine
22:48:56 <jeffh> bhill:  there's the allow-from stuff
22:49:46 <jeffh> daver: now by using csp we can take advantage of csp infrastruc;  still a tad worried about sites emitting huge bloated headers
22:50:12 <jeffh> tanvi:  mozilla was thinking the policy-uri directive is one way to address that
22:50:33 <jeffh> bhill: still an open issue whether we want to include that policy-uri in the draft
22:50:43 <jeffh> bhill: this may be use case for that
22:51:18 <jeffh> daver:  sitll a little worried that since you /can/ just cut & paste a ton or origins into that header that that's what we'll get.....
22:51:47 <jeffh> bhill: any limits to # of tokens you'll parse in allowed-srcs ?
22:51:51 <jeffh> ?: not in FF
22:51:58 <tanvi> ?=imelven
22:52:03 <jeffh> thx
22:52:16 <jeffh> nominal ans:  all of virt memory
22:52:32 <tanvi> there is a max header size, not sure what that is
22:52:38 <jeffh> yeah
22:52:42 <tanvi> but if we use policy-uri that is nto an issue
22:53:14 <jeffh> bhill:  will get edits into spec
22:53:40 <Zakim> -neil
22:53:41 <Zakim> -gmaone
22:53:41 <Zakim> -[Mozilla]
22:53:42 <Zakim> -[Microsoft]
22:53:42 <Zakim> -ekr
22:53:44 <Zakim> - +1.650.648.aaff
22:53:44 <Zakim> - +1.781.369.aagg
22:53:45 <Zakim> - +1.415.596.aaee
22:53:46 <jeffh> bhill: meeting adjourned -- please take survey !!
22:53:47 <bhill2> thanks for scribing, Jeff!
22:53:47 <Zakim> -mkwst
22:53:49 <tanvi> tanvi has left #webappsec
22:53:51 <jeffh> welcome :)
22:53:53 <Zakim> -dveditz
22:53:57 <bhill2> rrsagent, make minutes
22:53:57 <RRSAgent> I have made the request to generate http://www.w3.org/2013/02/26-webappsec-minutes.html bhill2
22:54:01 <bhill2> rrsagent, set logs public visible
22:54:07 <bhill2> zakim, list attendees
22:54:07 <Zakim> As of this point the attendees have been bhill, +1.866.317.aaaa, gmaone, JeffH, jimio, +1.415.426.aabb, +1.650.678.aacc, neil, +1.650.488.aadd, mkwst, [Mozilla], dveditz, ekr,
22:54:10 <Zakim> ... [Microsoft], +1.415.596.aaee, +1.650.648.aaff, +1.781.369.aagg
22:54:12 <Zakim> -JeffH
22:54:16 <bhill2> rrsagent, make minutes
22:54:16 <RRSAgent> I have made the request to generate http://www.w3.org/2013/02/26-webappsec-minutes.html bhill2
22:54:33 <bhill2> rrsagent, set logs public visible
22:54:35 <bhill2> bhill2 has left #webappsec
22:54:41 <Zakim> -bhill
23:00:54 <neil_> neil_ has joined #webappsec
23:05:01 <Zakim> disconnecting the lone participant, jimio, in SEC_WASWG()5:00PM
23:05:02 <Zakim> SEC_WASWG()5:00PM has ended
23:05:02 <Zakim> Attendees were bhill, +1.866.317.aaaa, gmaone, JeffH, jimio, +1.415.426.aabb, +1.650.678.aacc, neil, +1.650.488.aadd, mkwst, [Mozilla], dveditz, ekr, [Microsoft], +1.415.596.aaee,
23:05:02 <Zakim> ... +1.650.648.aaff, +1.781.369.aagg
23:25:27 <abarth> abarth has joined #webappsec