<HTML><BODY style="word-wrap: break-word; -khtml-nbsp-mode: space; -khtml-line-break: after-white-space; ">Hi Eddy,<DIV><BR><DIV><DIV>On Sep 24, 2007, at 10:45 AM, Eddy Nigg (StartCom Ltd.) wrote:</DIV><BR class="Apple-interchange-newline"><BLOCKQUOTE type="cite"> Pat Patterson wrote: <BLOCKQUOTE cite="mid:3E64A1A9-0AAE-45B7-ACBC-FF291F9E3E65@sun.com" type="cite">I don't understand this from section 11.5.2: <DIV> <DIV>Surely, if an attacker gained control of the HTTP URL, he would be free to redirect to an endpoint of his choosing, a clear reduction in security. Am I missing something?</DIV> </DIV> </BLOCKQUOTE> HTTP URL = Web site? <BR> HTTP = DNS?<BR></BLOCKQUOTE><BR>I don't know - I was quoting the section of spec you included in a previous message.</DIV><DIV><BR><BLOCKQUOTE type="cite">Surely, if an attacker gained control of the HTTP<B>S</B> URL this would be a clear reduction in security.<BR></BLOCKQUOTE><DIV><BR class="khtml-block-placeholder"></DIV>Clearly :-)</DIV><DIV><BR><BLOCKQUOTE type="cite">Guess you don't miss anything.<BR></BLOCKQUOTE><DIV><BR class="khtml-block-placeholder"></DIV><DIV>I try not to, but... I'm still don't get it.</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>Let's say I compromise DNS, sending traffic for eddy.someidp.com to www.myevilidp.com. To initiate the discovery process, you type in <A href="http://eddy.someidp.com">http://eddy.someidp.com</A> at an RP. The RP goes to <A href="http://www.myevilidp.com">www.myevilidp.com</A> and he is in my clutches. I can send the RP to an http or https endpoint of my choosing.</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>On the other hand, let's say I compromise the someidp.com web site. Again, if an RP does discovery on <A href="http://eddy.someidp.com">http://eddy.someidp.com</A>, I am free to send the RP anywhere I like, http or https.</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>As far as I can see, it's only by the RP doing discovery on <A href="https://eddy.someidp.com">https://eddy.someidp.com</A> that he gains any benefit from HTTPS.</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>Cheers,</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>Pat</DIV><DIV><BR class="khtml-block-placeholder"></DIV><BLOCKQUOTE type="cite"><DIV class="moz-signature">-- <BR> <TABLE border="0" cellpadding="0" cellspacing="0"> <TBODY><TR><TD colspan="2">Regards </TD></TR><TR><TD colspan="2"> </TD></TR><TR><TD>Signer: </TD><TD>Eddy Nigg, <A href="http://www.startcom.org">StartCom Ltd.</A></TD></TR><TR><TD>Jabber: </TD><TD><A href="xmpp:startcom@startcom.org">startcom@startcom.org</A></TD></TR><TR><TD>Blog: </TD><TD><A href="http://blog.startcom.org">Join the Revolution!</A></TD></TR><TR><TD>Phone: </TD><TD>+1.213.341.0390</TD></TR><TR><TD colspan="2"> </TD></TR></TBODY> </TABLE> </DIV> </BLOCKQUOTE></DIV><BR><DIV> <SPAN class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px 0px; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: auto; -khtml-text-decorations-in-effect: none; text-indent: 0px; -apple-text-size-adjust: auto; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px; "><SPAN class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px 0px; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: auto; -khtml-text-decorations-in-effect: none; text-indent: 0px; -apple-text-size-adjust: auto; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px; "><SPAN class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px 0px; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: auto; -khtml-text-decorations-in-effect: none; text-indent: 0px; -apple-text-size-adjust: auto; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px; "><SPAN class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px 0px; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: auto; -khtml-text-decorations-in-effect: none; text-indent: 0px; -apple-text-size-adjust: auto; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px; "><DIV>- - - - -</DIV><DIV>Pat Patterson</DIV><DIV>Federation Architect, Sun Microsystems, Inc.</DIV><DIV>pat.patterson@sun.com - <A href="http://blogs.sun.com/superpat">http://blogs.sun.com/superpat</A></DIV><DIV>- - - - -</DIV><DIV>Join OpenSSO today! <A href="http://opensso.dev.java.net">http://opensso.dev.java.net</A>/</DIV><DIV>- - - - -</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV><BR class="khtml-block-placeholder"></DIV><BR class="Apple-interchange-newline"></SPAN></SPAN></SPAN></SPAN> </DIV><BR></DIV></BODY></HTML>