<div class="gmail_quote">On Tue, Jun 8, 2010 at 12:45 PM, SitG Admin <span dir="ltr"><<a href="mailto:sysadmin@shadowsinthegarden.com">sysadmin@shadowsinthegarden.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div>
<div>Just passing through, between one relay and another:</div><div class="im">
<div><br></div>
<div>>Thought experiment: Would you be satisfied if xauth
were baked into Chromium (hosted at <a href="http://www.chromium.org" target="_blank">www.chromium.org</a>)? If so,
would it be sufficient to CNAME <a href="http://xauth.org" target="_blank">xauth.org</a> to <a href="http://www.chromium.org" target="_blank">www.chromium.org</a> and serve up JS
from there, signed with the Chromium.org private key?</div>
<div><br></div>
</div><div>Assume that ALL requests are protected with SSL, so that the
contents of communications cannot be spied upon. An eavesdropper can
STILL figure out when a user is logging in with OpenID (and, with
attention to timing, WHICH sites they are logged in to!) by looking
for requests to the IP address of the central server.</div></div></blockquote><div><br></div><div>(1) Assume the content is marked cacheable for a year, so in general an actual request to the central server will be a rare/semi random event; is this really a useful signal to attackers?</div>
<div><br></div><div>(2) If an eavesdropper can listen in on all your network traffic, can't they see your HTTP requests to IdP and RP (and everything else) directly?</div><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div>
<div><br></div>
<div>What do we expect them to do in defense of this attack, route all
their communications through random public proxies?</div></div></blockquote><div><br></div><div>If you are worried about MITM attacks between you and the Internet (or eavesdropping on all of your traffic patterns) then you probably want something along the lines of Tor routing as a basic start, yes.</div>
<div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div>
<div><br></div>
<div>-Shade</div>
</div>
</blockquote></div><br>