John,<div><br></div><div>Can you help me understand the risk of a replay if SSL protected the message such that you have very high confidence that the only person who could be replaying it is the person who should be able to log in anyway?</div>
<div><br></div><div>IOW, what's the problem with replay if there's no chance of MITM attacks? </div><div><br></div><div>On the other hand, I'm not entirely convinced that nonces are all that useful, since any MITM could also conceivably <i>pre</i>play the message, and get in anyway. Encryption seems to really be the best/only mitigation.<br clear="all">
--<br>Andrew Arnott<br>"I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre<br>
<br><br><div class="gmail_quote">On Wed, Jan 27, 2010 at 5:22 PM, John Bradley <span dir="ltr"><<a href="mailto:john.bradley@wingaa.com">john.bradley@wingaa.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
I think it has been increased. It would probably be a boon to the internet if all versions of IE prior to 8 are deprecated.<br>
<br>
However I have a hart time seeing websites turning people away due to old browsers.<br>
<br>
It is possible for a IdP to detect the browser and use GET up to 4K + if it is safe.<br>
<br>
That won't solve the problem that nonces do what they are supposed to and prevent token resubmission.<br>
<br>
John B.<br>
<div><div></div><div class="h5">On 2010-01-27, at 10:12 PM, Henrik Biering wrote:<br>
<br>
><br>
> John Bradley wrote:<br>
>><br>
>> The other alternative is to ban IE because it is the source of the 2K limit for GET.<br>
>> Not a problem for FF or other browsers.<br>
> Although I cannot find any official documentation, it seems that the traditional 2K limit for IE GET requests has been increased significantly in IE8<br>
><br>
> =henrik<br>
<br>
</div></div><div><div></div><div class="h5">_______________________________________________<br>
specs mailing list<br>
<a href="mailto:specs@lists.openid.net">specs@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs</a><br>
</div></div></blockquote></div><br></div>