security

[Dan Lyke]

By the way, thank you, this is exactly the sort of thing I was hoping  
to elicit from those on the "HTTPS WILL SOLVE EVERYTHING! LALALA I  
CAN'T HEAR YOU LALALALA" side.

On Wed, 25 Oct 2006 00:11:23 -0700, Martin Atkins wrote:
> * The identity URL SHOULD be on an SSL server, but due to  
>    real-world adoption problems early adopters will
>    probably not use SSL.

If, indeed, DNS spoofing is a widespread attack vector or is likely to  
become one (when all the more obvious methods get more expensive),  
then this looks like the big one to me, because it's going to require  
SSL based vanity domains.

On the other hand, if the IdP Endpoint URL is HTTPS with a checked  
certificate, then if someone is attempting a man-in-the-middle attack  
at least there's an audit trail back through the Certificate Authority.

However, if that's the case then the Identity URL also has an audit  
trail.

So what does it solve that the Identity URL is HTTPS? (There's  
probably something, I don't know and am just working through the  
implications)

Dan