Re: Fwd: Re: [Cryptography] Encryption opinion

On 29/08/2014 12:12 AM, Karp, Alan H
wrote:

I
don’t see any security issue in your Amazon examples. What’s
the protected resource, and what’s the threat to that resource?

I'm guessing that the protected resource is the user's account
with Amazon. That account contains their order history, possibly
their credit card, other personal information, etc. The ambient
account designator is what easily enables click-once
shopping on Amazon. So how you can distribute a public designator
that references a closely held client resource without being
vulnerable to confused deputies? If you can't, how close can you
get while remaining safe?

This problem has come up on this list before, without any really
satisfactory solutions that I can recall. A typical capability
solution (Waterken) would be to navigate to that page starting
from your account page, which breaks the usability of URLs in
these cases.

Seems like the only usable solution is the browser
being aware of this specific pattern, and executing a
protocol to access the account-specific equivalent of the linked
page for you. I'm not sure if this is even safely implementable
with Caja. You don't want the DOM for the account/click-once
section to be accessible to any other code in any windows, or
you're vulnerable to clickjacking. This is comparable to the title
bar being in Polaris' TCB, or the top of the screen being in the
TCB of the EROS trusted window system.

Sandro

_______________________________________________
cap-talk mailing list
[email protected]
http://www.eros-os.org/mailman/listinfo/cap-talk