[Openid-specs-fapi] Issue #504: Attacker Model - Browsers and Endpoints (openid/fapi)

[dgtonge]

New issue 504: Attacker Model - Browsers and Endpoints
https://bitbucket.org/openid/fapi/issues/504/attacker-model-browsers-and-endpoints

Dave Tonge:

>From an email from Nat:

Currently, the attacker model states:

* **Browsers and Endpoints:** Devices and browsers used by resource owners are considered not compromised. Other endpoints not controlled by an attacker behave according to the protocol.

This kind of deviates from the assumption for FAPI 1.0. We wanted to sign the requests and responses because the TLS breaks in the browser and can be tampered with. Is this captured elsewhere in the attacker model?