[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Captive-portals] The architecture requiring that the API be secure



Kyle Larose <[email protected]> wrote:
    > Issue #6 in the architecture draft
    > (https://github.com/capport-wg/architecture/issues/6) was raised to
    > point out that we should really mandate that the API be secure.

I entered some comments on the github issue.

    > Basically, we want to make TLS a requirement, not a suggestion, so I've
    > changed the wording around TLS to reflect this. I also added a section
    > to the security section discussing the motivation behind the
    > requirement.

I think that we have to deal with Martin's points about all the ways that the
certificate behind HTTPS can be broken.  I don't want to see overrides for
that certificate.

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        | network architect  [
]     [email protected]  http://www.sandelman.ca/        |   ruby on rails    [