Re: Fwd: Re: [Cryptography] Encryption opinion
"Karp, Alan H" <[email protected]>
| Newsgroups | gmane.comp.capabilities.general |
|---|---|
| Message-ID | <8AD823089998C849A832D86972E69CD54191162F@G4W3222.americas.hpqcorp.net> |
ihab wrote: Let's say I built a Web browser with the following properties: * No same-origin policy * No domain restrictions on HTTP requests * Local storage (of any form) only accessible to the specific page that created it (an equality function on URLs is defined) * Pages may grant one another access to local storage by sharing capabilities You would assert that all the currently popular patterns of commerce that make use of the ambient authority afforded by cookies can be conveniently and usably implemented? Yes, and I’ll get back to you in a few years after I’ve figured out how to do it ☺ On a more serious note, there are OAuth flows that do the kind of handoff needed for these use cases. For example, in a couple of web redirects, my authorization manager could transfer to a script on your blog an OAuth token authorizing the purchase of a blender using my Amazon account. ________________________ Alan Karp Principal Scientist Enterprise Services, Office of the CTO Hewlett-Packard Company 1501 Page Mill Road Palo Alto, CA 94304 (650) 857-3967, fax (650) 857-7029 http://www.hpl.hp.com/personal/Alan_Karp From: [email protected] [mailto:[email protected]] On Behalf Of [email protected] Sent: Monday, September 01, 2014 2:38 PM To: General discussions concerning capability systems. Subject: Re: [cap-talk] Fwd: Re: [Cryptography] Encryption opinion So Alan, here's a question. Let's say I built a Web browser with the following properties: * No same-origin policy * No domain restrictions on HTTP requests * Local storage (of any form) only accessible to the specific page that created it (an equality function on URLs is defined) * Pages may grant one another access to local storage by sharing capabilities You would assert that all the currently popular patterns of commerce that make use of the ambient authority afforded by cookies can be conveniently and usably implemented? Ihab _______________________________________________ cap-talk mailing list [email protected] http://www.eros-os.org/mailman/listinfo/cap-talk