Re: Fwd: Re: [Cryptography] Encryption opinion

Sandro Magi wrote:
> 
> In Ihab's blog, he just needs to create a page with a button that says
> "Animate Kittens", but which overlays the "buy now" Amazon button to
> trigger a $10,000 purchase. This is preventable in Waterken because the
> URLs are unique for all clients with a "buy now" button.
>
A clickjacking attack.  I had taken Ihab's comments to denote a more direct attack.  (Does clickjacking work if I open the page in a different tab?)

Of course, the way Amazon works for me is that I get prompted for my password before I can spend any money.  That means even clickjacking will fail if the order page is at an unguessable URL.  (It isn't, but it could be.)

________________________
Alan Karp
Principal Scientist
Enterprise Services, Office of the CTO
Hewlett-Packard Company
1501 Page Mill Road
Palo Alto, CA 94304
(650) 857-3967, fax (650) 857-7029
http://www.hpl.hp.com/personal/Alan_Karp


> -----Original Message-----
> From: [email protected] [mailto:cap-talk-
> [email protected]] On Behalf Of Sandro Magi
> Sent: Sunday, August 31, 2014 5:28 AM
> To: General discussions concerning capability systems.
> Subject: Re: [cap-talk] Fwd: Re: [Cryptography] Encryption opinion
> 
> On 31/08/2014 12:59 AM, Karp, Alan H wrote:
> > I don't see that the ambient authority is an issue in this particular
> > case. Ihab's blog may determine which page I see at Amazon, but Ihab
> > has no authority over that page even with ambient authority.
> 
> Ihab's blog has precisely the same authority over the Amazon page as the
> client of the compiler in the Confused Deputy scenario has over the
> billing path, ie. they can both designate a protected resource and
> confuse the agent with permission to write to that resource (the
> compiler, Amazon respsectively) into doing something undesirable.
> 
> In Ihab's blog, he just needs to create a page with a button that says
> "Animate Kittens", but which overlays the "buy now" Amazon button to
> trigger a $10,000 purchase. This is preventable in Waterken because the
> URLs are unique for all clients with a "buy now" button.
> 
> So how can a user be automatically redirected this unique URL from the
> public URL without also permitting malicious scripts from doing so?
> 
> Sandro
> 
> 
> _______________________________________________
> cap-talk mailing list
> [email protected]
> http://www.eros-os.org/mailman/listinfo/cap-talk