Why using SWFP rather than HTTP over SSL?

Frederick Giasson

This legitimate question has been asked by Daniel Lemire after his reading of the SWF protocol. There is my answer to his question. I added it as the section 7 of my SWFP paper.

The question is hard to answer because it depends on many factors. I’ll compare the two methods together and try to show you the differences between the two protocols.

Usually SSL is used to authenticate the server to the client and, optionally, the client to the server. With the cost of authentication certificates (about 100£ each), the normal clients can’t afford these authentication certificates. It’s why SSL is mainly used to authenticate servers.

Our goal is especially to authenticate the readers to the server. It’s a reason why using SSL as a secure channel and an authentication protocol is not so useful: because the implementation cost is too high; like the revised version of SWFP at section 5.

This is the big difference between SWFP and SSL: their goals.

A solution could be to use HTTP over SSL (HTTPS) with HTTP Authentication. HTTPS would provide the secure channel and HTTP Authentication would provide the authentication mechanism. The problem with this solution is that some feed readers only implement HTTPS, others HTTP Authentication and few implement both. Another problem with this solution is that who says HTTP Authentication also says login and password. In SWFP the authentication is inherent to the system. It’s made with the public key of the legitimate reader present in the secure database of the server. The authentication steps of the reader to the server are transparent to him. I think that this transparency feature is an important one because it simplify the process and brings non-expert users to use it. Only the simpler things, in appearance of, are widely used.

Two types of feed readers are available: the web applications like Bloglines or the standalone software like Omea Reader. Both principles, HTTPS with HTTP Authentication and SWFP, could be implemented in standalone software and the implementation time, cost and difficulty are probably comparables. However, I think that SWFP would be much more easer to implement in web applications. Why? To use HTTPS with HTTP, the web applications would need to create the secure channel themselves with the feed’s server. By example, Bloglines itself would need to create the secure channel with each private feed server. I don’t think that it’s imaginable. However, with SWFP nothing like that would be necessary because the encrypted feed is viewable by anyone who needs it, even web applications. If I check the FeedBurner stats of my blog: 30% of my readers use Bloglines. I think that it’s considerable and that we need to take this fact in count.

Another problem with the HTTP Authentication solution is that it’s not an optimal solution to our problem. If a user is subscribed to many private feeds then he’ll need to enter, each time, a login and password to check the feeds. Personally I don’t think that this is viable. Think about the pain such a situation would engender… nobody would subscribe to such feeds.

Finally one of the beauties of web feeds is that you can archive them for future readings. The problem with the HTTPS solution is that you didn’t really have the choice to archive the encrypted or the unencrypted content. But such a choice is possible with SWFP.

Technoratie: [] [] [] [] []

SWFP: Secure Web Feed Protocol – A protocol to ensure a secure channel to web feeds

Frederick Giasson

The last weekend an idea passed through my mind: “It seems that more companies are using content syndication technologies to broadcast their news or information to their employees”. Then I started to write a protocol to take this fact in count. It’s called: SWFP, Secure Web Feed Protocol.

“SWF is a protocol to ensure the secure broadcasting of web feeds’ content over a local network or the Internet. The protocol ensures the encryption of the feeds and the distribution of their encryption symmetric keys.”

It was supposed to be the draft of an idea, something to post here. Finally it revealed to be an article of 12 pages. I worked on it this week and came with this first draft:


View: SWFP: Secure Web Feed Protocol [PDF file]

If you have any question about this paper, don’t hesitate to contact me. If you find flaws in the protocol or modifications to suggest send them to me, they’ll be warmly welcome. I also invite you to leave your comments about this paper here, on this post.

Technoratie: [] [] [] []

Spamming problems on Del.icio.us; you don’t really need to validate your account

Frederick Giasson

I was surprised to see, this morning, a sort of bookmark spam attack in one of my Del.icio.us feed (tag:writing). I had around 30 bookmark entries with user names like: rollofle500, rollofle502, rollofle503? etc. All the messages have been sent at a minute of interval with different tags, different topics and all linked to the same website: http://torrents.on.nimp.org/?u=rolloffle that redirect us to http://www.gnaa.us/. I think the attack have been performed with an automated script that worked like this:

  1. He creates an account with a random name and a random email address.
  2. He login to this newly created account.
  3. He post a bookmark with this newly create account and put random tags that he get in a special word dictionary created for this effect.
  4. Finally he restarts the whole process.

It seems that the administrator of Del.icio.us had deleted these users and entries. They probably have been alerted of the situation and deleted them on the spot.

The problem is that erasing all the entries hadn’t repaired the entire problem because their feeds have been infected and distributed to hundred of subscribed users.

We are in right two ask this question: Why this situation happened? The answer is ease: because their authentication is not working properly. You can post bookmarks without validating your account. This is the real problem and why the spammer had been able to perform this sort spam attack. Even if you see this message:

» A verification email has been sent. Please check your mail. If it does not arrive shortly, go to the settings page and ask for another verification email.

You can do what you wish with your account.

What’s the solution to prevent future bookmark spam attacks on Del.icio.us? They will need to upgrade their registration and validation system to prevent the new users to be able to post bookmarks without being validated by the system.

Technoratie: [] [] [] [] []

Updates on: Quebec dams open to terrorists’ attacks

Frederick Giasson

A week later, a journalist of TVA enters LG2 without being intercepted.

There are some updates on yesterday news. Mr. Caillé knew that Radio Canada would broadcast this report for more than a week. Yesterday a journalist of TVA, another French Canadian news network, had entered in LG2, without being seen. They explored the site for about 2 hours; they entered a repair shop, found blue print plans and Hydro-Quebec trucks with keys on the starter. It’s unbelievable. What do they need to do the make them react? Do they need to put bombs at LG2? If I’m going there tomorrow, will I be able to go anywhere I want without seeing any security agents and enter every door I see (because they are virtually all unlocked)? It’s not a game; it’s serious: they need to do something. These people, these administrators, don’t seem to understand what is going on, what?s the treat. We don’t live in wonderlands. Is 9/11 already forgotten? Did we learn anything from this event? …I can’t believe it.

Video report of TVA (french)

Technoratie: [] [] [] []

Quebec dams open to terrorists’ attacks – And the USA his one of our main client.

Frederick Giasson

First, read this piece of news about the security of Quebec’s dams: Quebec dams open to attack, probe suggests. Everybody is talking about this report done by a journalist of Radio Canada. I saw the report on the TV and it’s awesome. The authorities can’t say that the security is correct; it is not. The journalist had reached the core of two major dams in the north of Quebec without being seen. Was he hiding? No, he looked like a tourist with a huge camera on his shoulder and his big white truck. He was able to stop the electric production of about 500 000 homes; he reached the main controls of the power plants without anyone intercepting him? he was alone in the complex. He never meets any employee or security guards in about 1 hour of door opening and investigation on each site. There was no evident camera (the authorities say that they are hidden). The problem is that it seems that they are not monitored by permanent security guards. Sorry but tell you it, Mr. Caillé, but Hydro-Québec is not a chain of corner shops; the camera don’t have the same utility in a corner store and in power plant of billions of dollars. Cameras in the first one are there to know who the criminal was. In the second, they are there to prevent criminals to reach the dam.

Okay, you know what’s the problem? It’s probably easiest to enter in this critical infrastructure of Quebec than to enter in any home on the territory. This situation is definitely unacceptable after the 11 September 2001. Some ones will say that we have nothing to fear; that we don’t have any enemies and it would be an unnecessary spend of money. To them, I’ll say that: first, we get problems with French separatists for more than 40 years. Last years, an unknown group had put dynamite on a main transmission pole and they pull the trigger. What if they had reached the core of the Manic 5 central, or LG2? The result had would be catastrophic. What if they do this in a cold wave of 1 or 2 weeks with temperatures under 30 or 40 degree Celsius? We probably wouldn’t be able to buy electricity at the USA or Ontario because they just wouldn’t have enough. Then, we would be in great troubles.

After, think about it. Our greatest electric client is the USA. We sell megawatts of electricity on the east cost market. If two of our main dams are the target of international terrorism it’ll not just be a catastrophe for the village around the dams (who will probably be flooded) but also for the entire east cost of America. Think back, the major black out that occurs a year or two ago on the east cost. The electric switch in new New-York city was turned at off and they didn’t have electricity at all for some days; no air conditioning in the middle of a dog days. This total back out was the result of a problem in a switch complex somewhere in the north east of the USA. Think about what it would be like if 2 or 3 of the main dams of the north east of America would be shutdown or destroyed? I don’t want to think about it. If international terrorists need to hurt the USA, then one of their best bet would probably to destroy these dams. It’s easy, as demonstrated above, and effective.

Finally, if there is no security at all for these dams, what’s the security of our nuclear power plant? Is this the same situation? I hope no, otherwise it would be the problem of many more person than the millions habitants of the east coast of America. It’s my reaction to the situation. I hope the government of Quebec will get enough pressure to move and spent money to arrange the situation. The current situation is unacceptable; and for the stability of the Quebec, the Canada and the United-States, we need to act now.

What can we do? Talk about the situation. Are you Canadian or American? Talk about it, wrote about it in hope that these things put pressure on Hydro-Québec and the government of Quebec to obligated them to act and increase the security of these sites.

Update 17-02-2005: The video report(french)

Technoratie: [] [] [] []