Re: Google Docs as capabilities as data

Le 28/01/2014 15:23, Rob Meijer a écrit :
> I think its a very good start, though there are some things that could use
> some improvements:
>
> 1) "https://docs.google.com" : In order to prevent a man in the middle
> attack, this part relies on a quite long list of certificate authorities.
> Replacing the 'docs.' part with a hash-over-pubkey string could be a major
> improvement there (assuming browsers or browser pluging could work with
> it).
I'm not sure I ever understood that part. Who hashes what? client or 
server? How does it prevent a mitm?

> 2) If you type "https://docs.google.com/doc" you probably notice some kind
> of auto-complete showing your sparse-cap URL. Browsers don't look at urls
> as caps-as-data, they do all kinds of stupid things with them (like using
> them for auto complete, etc). The only way to fix this is I think making
> browsers less stupid.
Do people type things in URL bars anymore? </troll>
How much worse is it than passwords?
For reasonable usability, people save passwords the same way the browser 
saves the browsing history.

> 3) The "/document/d/10-qbHlInBNtlK3S9awzSTUbKyIkDZxEEr3sgD2VIga" part
> containing the sparse-cap may very well end up in referrer headers sent by
> the browser to sites referred from the document.
There is a proposal (implemented by no one yet) of a <meta referrer> so 
the person creating the page decides what gets sent as referer.
http://wiki.whatwg.org/wiki/Meta_referrer
Lobby or contribute to open source browsers?

It's possible to hide things from the URL bar using the history API
https://developer.mozilla.org/en-US/docs/Web/Guide/API/DOM/Manipulating_the_browser_history?redirectlocale=en-US&redirectslug=Web%2FGuide%2FDOM%2FManipulating_the_browser_history
Supported everywhere except IE9-
This helps against shoulder browsing and referrer.

The W3C TAG (Technical Architecture Group, a group where there is TBL 
for instance) has capability URLs in its agenda
http://w3ctag.github.io/capability-urls/
Now might be the right time to weigh in.

David