<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">I suspect that we will disagree on the utility of token binding.<div class=""><br class=""></div><div class="">For inbound traffic yes people use deep packet inspection and those devices can support token binding/Fido in the same way that they support mutual TLS now.</div><div class=""><br class=""></div><div class="">Outbound inspection for DLP is more complicated, but there are some discussions around how that might be accomplished via a trusted proxy.</div><div class=""><br class=""></div><div class="">There may be other methods to detect man in the middle, but the RP/SP needs to be aware of what is happening and put appropriate mitigations in place.</div><div class=""><br class=""></div><div class="">I think that it is hard to argue that ignoring session hijacking is OK because there are some “legitimate” uses for it.</div><div class=""><br class=""></div><div class="">Banking malware is starting to modify users DNS entries to send them to phishing sites, home routers are also being compromised in similar ways.</div><div class=""><br class=""></div><div class="">In my opinion at some point in the not too distant future TLS everywhere and detection of session hijacking will not just be for LOA 4 applications but also commonplace in financial and health applications.</div><div class=""><br class=""></div><div class="">Understanding the risks and mitigations is important. </div><div class=""><br class=""></div><div class="">The Enhanced Authentication Profile (EAP) WG is working on Token Binding ID Tokens via the browser. <a href="http://openid.net/specs/openid-connect-token-bound-authentication-1_0.html" class="">http://openid.net/specs/openid-connect-token-bound-authentication-1_0.html</a></div><div class="">There will also be work on tying that to Fido.</div><div class=""><br class=""></div><div class="">My main point was that there is confusion about authentication channel session integrity and anti hijacking vs access channel integrity and anti hijacking.</div><div class=""><br class=""></div><div class="">Regards</div><div class="">John B.</div><div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Dec 4, 2016, at 9:15 AM, Chris Drake <<a href="mailto:cnd@geek.net.au" class="">cnd@geek.net.au</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><title class="">Re: [Openid-specs-igov] Our conversation on SP-800-63-B</title>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" class="">
<div class="">
<span style=" font-family:'Calibri'; font-size: 12pt;" class="">Hi John,<br class="">
<br class="">
TLS channels are never useful for anything, because no self-respecting organisation nowdays allows non-proxied internet access: malware over TLS is simply too dangerous (it *must* be scanned for), as is data exfiltration: everything is behind deep-packet-inspection nowdays; this includes most schools and universities, many business, government, and military organisations, as well as entire *countries* who are forced to install their government CA to get internet access.<br class="">
<br class="">
So the problem is easy to break down: how do you guarantee end-to-end protection yet specifically *permit* these proxies? Users need to be involved.<br class="">
<br class="">
As you point out, typical users click "yes" when prompted, which presents another problem: how to protect users against themselves? More than 90% of government web site have no TLS whatsoever (and 100% of people behind deep-packet-inspectors have no trustworthy TLS at all), making "SSL Strip" or any other kind of interception trivial - so how do you "save" an ordinary end user against authentication attack through <b class=""><a href="http://A.gov" class="">http://A.gov</a> </b>when they *should* be authenticating through <b class=""><a href="https://B.gov" class="">https://B.gov</a> </b>(in a situation where <a href="http://A.gov" class="">A.gov</a> is malicious (or used maliciously via the proxy/intercept), and simply exists to trick the user into authenticating the attacker, who is on <a href="http://B.gov" class="">B.gov</a>)?<br class="">
<br class="">
Once again - the user needs to be involved.<br class="">
<br class="">
In both user-involvement situations, they need to be "untrickable": no "yes/no" question should be presented.<br class="">
<br class="">
One solution to all these problems is a browser-supported authentication component which generates a hash of the symmetric session key for the browser connection together with some unique-to-the-user local information from their device, and this hash is used as a key to present to the user some easy-to-solve puzzle (eg: click on the matching image; where the images shown are selected from a large set, the selection based on the hash), and the website wanting to be authenticated shows to the user the one image they need to click on to approve (the "challenge" image): in the event of any in-the-middle attack, *and/or* in the event of the malicious attacker wanting to trick the user, there will never be any matching image for the potential victim to click on - so we have a foolproof (literally) way to ensure that in-the-middle attacks are revealed - at which point the user can optionally then be prompted to accept or reject the identity of this intermediary (the deep-packet-inspection infrastructure's certificate): or more likely; in conjunction with the browser component, this can be either automatically rejected (e.g. for home users who do expect to be behind such things) or automatically accepted (for businesses who have deployed this to their worker machines) or for the discerning security-educated user - an actual prompt can be shown to allow them to examine the interception and approve if they so wish.<br class="">
The *two* subsequent sets of symmetric keys can then be used again to produce the hash, which this time *will* allow the user to match the challenge photo from the requesting web site.<br class="">
<br class="">
Personally - I cannot see any point whatsoever in building anything that does not protect an ordinary user against some trickster scamming them into authenticating the trickster (via <b class="">any </b>means), and of course, there is literally no point building anything that can't work if your employer has deep-packet-inspection activated - heck - I'm an ordinary home user, and my wifi switch has this option installed and turned on by default *itself*. And it's just plain dangerous to build something that purports to solve these problems, but then has them disabled later (cough, FIDO), on account of them not thinking the DPI problem through properly going live.<br class="">
<br class="">
Kind Regards,<br class="">
Chris Drake<br class="">
<br class="">
<br class="">
Sunday, December 4, 2016, 3:50:29 AM, you wrote:<br class="">
<br class="">
</span><table class=""><tbody class=""><tr class=""><td width="2" bgcolor="#0000ff" class=""><br class=""></td><td class=""><span style=" font-family:'calibri'; font-size: 12pt;" class=""><br class="">
<br class="">
</span></td>
</tr>
</tbody></table>
<br class=""><br class="">
<br class="">
</div></div></blockquote></div><br class=""></div></body></html>