<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
BTW, did anybody of you notice, that the exchange of information
(assoc_handle / shared secret) between the RP and IDP is completely
optional? <br>
<br>
<div class="moz-signature">-- <br>
<div><font face="Arial" size="2">Regards</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">Signer: Eddy Nigg, StartCom Ltd.</font></div>
<div><font face="Arial" size="2">Phone: +1.213.341.0390</font></div>
</div>
<br>
Pete Rowley wrote:
<blockquote cite="mid45425906.3050001@redhat.com" type="cite">Dan Lyke
wrote:
<br>
<blockquote type="cite">On Fri, 27 Oct 2006 11:49:13 -0700, Pete
Rowley wrote:
<br>
<blockquote type="cite">That was the point of the original attack -
causing someone to log into an account controlled by the attacker.
<br>
</blockquote>
<br>
Martin's point is that the Relying Party needs to process the
redirected-to URL as the identifier, so if this redirect URL is new to
the Relying Party, it should be treated as an entirely new URL, not
the one the user initially entered.
<br>
</blockquote>
And my point is that that is the whole point - a user is logged into an
account controlled by an attacker. The problem is "if this redirect URL
is new to the Relying Party" is like saying "if this is a badly crafted
attack."
<br>
<br>
</blockquote>
<br>
</body>
</html>