Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I heard the idea of encrypting the RSS feeds using public key encryption system from someone and since then I am intrigued by the idea. But then I started to wonder what would be the basic need for someone to encrypt their RSS feeds but, could figure it out myself.

I need ideas about why someone wants to encrypt their feeds. This would help me to take a decision whether RSS public-key encryption is something worth doing. I also would like to see if there are any other encryption systems and if they failed to satisfy people and why?

share|improve this question
    
By "public key encryption system" do you mean SSL, or a custom crypto scheme? If it's the latter, you're going to have to give us some more information about how that system works. –  Polynomial Jan 7 '13 at 11:42
    
@Polynomial: What if I want to publish RSS feeds only to a group of people, rather than all the people on the internet?This might require a custom crypto scheme I guess. –  bobbyaldol Jan 7 '13 at 12:13
add comment

4 Answers

If you're talking about SSL, the answer is why not? If I had the choice, I'd prefer that every site on the internet provided HTTPS. Is it strictly necessary? Of course not. Does it stop anyone from snooping on my content? Yes. Does it reduce the chances of an attacker injecting content into a page via man-in-the-middle? Yes. Are either of these scenarios likely to occur? Not really. It's just a case of what you find comfortable.

In terms of the effort required by the RSS feed provider, it's largely dependant on the type of content and types of user that will be subscribing. If it's a feed of posts from the EFF, then you damn well better make sure it's done over HTTPS. If it's a feed of muffin recipes, it's not so much of an issue.

share|improve this answer
    
Does SSL enable us to do this: I have data that I want to syndicate to myself, but I don't want you to see it. It's private. Now this could be my credit card balance or internal bug reports for the day job. Either way, I want the information in a form suitable for syndication but not available to everyone. –  bobbyaldol Jan 7 '13 at 12:31
1  
Sure, SSL would be useful there. You'd need to set up client certificates to authenticate yourself, too. –  Polynomial Jan 7 '13 at 12:35
add comment

Given that RSS feeds are simply summarised web pages then the requirement to encrypt the data would be driven by the general need to encrypt the original information hosted on the website.

However, you've got to be careful when using technology to drive a solution.

  1. Is RSS the right technology to deliver secured content to a user?
  2. Are there alternative technologies that already have appropriate authentication, authorisation and privacy capabilities that more be more suitable.

As far as I can see it, most RSS readers already support SSL but don't normally support authentication.

share|improve this answer
add comment

Encryption is for confidentiality: this is to prevent just anybody to access the data. This needs to be coupled with authentication, which is about identifying people who should be able to access the data, and reliably making sure that they are who they claim to be.

RSS is an optimized way to publish some Web-accessible contents (tailored for data which is frequently updated). You want to manage the diffusion of RSS streams with exactly the same security policy as those which are applied on the publication of the same data as "simple Web". In particular, you will want to do encryption and authentication for the RSS stream for exactly the same reasons that you would want to do encryption and authentication on the source Web site. And you would be well advised to do it with the same proven technology, i.e. HTTPS (aka "HTTP within SSL").

To sum up: if the data is normally hosted on a Web site which does HTTPS and requires a user password, then the same data over an RSS stream should be also protected with HTTPS and password-based authentication.

(Conceptual principle which is in action here: the needs for some security properties such as confidentiality come from the data itself, and do not vary with the way the data is being transferred, be it RSS or something else.)

share|improve this answer
add comment

To my mind the predominant value of PKI RSS encryption would be for authentication rather than confidentiality.

But what if I wanted to build a set of RSS feeds that matches my stock portfolio - I need authentication so that I get my portfolio and not somebody elses, and I need confidentiality because there is value in the selection of stocks that form my portfolio. Particularly if we're talking about a research portfolio, then the selection of stocks may be valuable and confidential. (in fact in some circumstances, I may be required to keep them confidential to avoid accusations of insider trading).

There may also be use cases in the field of medicine. I may not wish to publicly advertise the set of diseases/drugs/treatments that I'm tracking and researching.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.