<!doctype html public "-//W3C//DTD W3 HTML//EN">
<html><head><style type="text/css"><!--
blockquote, dl, ul, ol, li { padding-top: 0 ; padding-bottom: 0 }
--></style><title>Re: XAuth critiques</title></head><body>
<div>>I'm having trouble seeing how some additional once-per-year
cache revalidation requests to <a
href="http://xauth.org">xauth.org</a>'s IP would change the amount of
information leakage in any appreciable way.</div>
<div><br></div>
<div>Single point of failure = NON-centralization.</div>
<div><br></div>
<div>I assume the caching cannot be reset, and that your intent is to
get browser support within the year so it never has to be revalidated;
this would limit blocking/interception attacks.</div>
<div><br></div>
<div>I don't, however, understand why you can't set up a local proxy
server, temporarily bounce the JS request through it, and set the
cache accordingly. Post the source code, let everyone review it, then
let users download it from mirrors (verifying the hash against
anywhere it is published), creating a truly decentralized setup. (For
at least another year, they wouldn't have to worry about setting up
the cache again.)</div>
<div><br></div>
<div>There *is* a slightly higher barrier to entry, then, but it would
do a great deal to alleviate the concerns of those of us who see a
centralized service which *may*, in some idyllic future, become what
it was promised to be.</div>
<div><br></div>
<div>-Shade</div>
</body>
</html>