[Openid-specs-fapi] Issue #657: Fix sentence fragments (openid/fapi)
Nat
issues-reply at bitbucket.org
Tue Jan 9 08:02:38 UTC 2024
New issue 657: Fix sentence fragments
https://bitbucket.org/openid/fapi/issues/657/fix-sentence-fragments
Nat Sakimura:
There are a lot of sentence fragments in this document.
e.g.
> 4.1. A1 - Web Attacker
> Standard web attacker model. Can send and receive messages just like any other party controlling one or more endpoints on the internet. Can participate in protocols flows as a normal user. Can use arbitrary tools \(e.g., browser developer tools, custom software, local interception proxies\) on their own endpoints to tamper with messages and assemble new messages. Can send links to honest users that are then visited by these users. This means that the web attacker has the ability to cause arbitrary requests from users' browsers, as long as the contents are known to the attacker.
We need to turn them into full sentences.
In the case above, it reads as if Web Attacker == model, which I belive is not the case. When fully expanded, it would probably become something like below:
**4.1. A1 - Web Attacker**
A1 is a standard web attacker in this model. It
* can send and receive messages just like any other party controlling one or more endpoints on the internet;
* can participate in protocols flows as a normal user;
* can use arbitrary tools \(e.g., browser developer tools, custom software, local interception proxies\) on their own endpoints to tamper with messages and assemble new messages; and
* can send links to honest users that are then visited by these users. This means that the web attacker has the ability to cause arbitrary requests from users' browsers, as long as the contents are known to the attacker.
More information about the Openid-specs-fapi
mailing list