John, Can you help me understand the risk of a replay if SSL protected the message such that you have very high confidence that the only person who could be replaying it is the person who should be able to log in anyway?
IOW, what's the problem with replay if there's no chance of MITM attacks? On the other hand, I'm not entirely convinced that nonces are all that useful, since any MITM could also conceivably *pre*play the message, and get in anyway. Encryption seems to really be the best/only mitigation. -- Andrew Arnott "I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre On Wed, Jan 27, 2010 at 5:22 PM, John Bradley <[email protected]>wrote: > I think it has been increased. It would probably be a boon to the internet > if all versions of IE prior to 8 are deprecated. > > However I have a hart time seeing websites turning people away due to old > browsers. > > It is possible for a IdP to detect the browser and use GET up to 4K + if it > is safe. > > That won't solve the problem that nonces do what they are supposed to and > prevent token resubmission. > > John B. > On 2010-01-27, at 10:12 PM, Henrik Biering wrote: > > > > > John Bradley wrote: > >> > >> The other alternative is to ban IE because it is the source of the 2K > limit for GET. > >> Not a problem for FF or other browsers. > > Although I cannot find any official documentation, it seems that the > traditional 2K limit for IE GET requests has been increased significantly > in IE8 > > > > =henrik > > _______________________________________________ > specs mailing list > [email protected] > http://lists.openid.net/mailman/listinfo/openid-specs >
_______________________________________________ specs mailing list [email protected] http://lists.openid.net/mailman/listinfo/openid-specs
