<!doctype html public "-//W3C//DTD W3 HTML//EN">
<html><head><style type="text/css"><!--
blockquote, dl, ul, ol, li { padding-top: 0 ; padding-bottom: 0 }
--></style><title>Re: XAuth critiques</title></head><body>
<div>Just passing through, between one relay and another:</div>
<div><br></div>
<div>>Thought experiment: Would you be satisfied if xauth
were baked into Chromium (hosted at <a
href="http://www.chromium.org">www.chromium.org</a>)? If so,
would it be sufficient to CNAME <a
href="http://xauth.org">xauth.org</a> to <a
href="http://www.chromium.org">www.chromium.org</a> and serve up JS
from there, signed with the Chromium.org private key?</div>
<div><br></div>
<div>Assume that ALL requests are protected with SSL, so that the
contents of communications cannot be spied upon. An eavesdropper can
STILL figure out when a user is logging in with OpenID (and, with
attention to timing, WHICH sites they are logged in to!) by looking
for requests to the IP address of the central server.</div>
<div><br></div>
<div>What do we expect them to do in defense of this attack, route all
their communications through random public proxies?</div>
<div><br></div>
<div>-Shade</div>
</body>
</html>