Re: [certid] review of draft-saintandre-tls-server-id-check-09

[Matt McCutchen <[e-mail]>]

On Thu, 2010-09-23 at 20:15 +0200, Martin Rex wrote:
> Marsh Ray wrote:
> > It's not possible for a network security protocol to survive the 
> > compromise of one of the endpoints. We can no longer reason about Alice 
> > and Bob if Bob is allowed to be under the hypnotic control of Eve.
> 
> True.   I used the wrong words in what I was trying to say.
> 
> There is definitely little that you can do about a full compromise of
> the real server.
> 
> But blindly trusting browsers may easily turn seemingly small security
> vulnerability (every XSS, CSRF, content upload), that enables diverting
> a victim to the attackers own server seamlessly, close to equivalent to
> a full compromise of the real server for the purpose of capturing
> sensible or confidential information from the victim.

This is the design of the browser.  Trying to prevent it in
server-id-check (of all places) makes no design sense and would cause
many more problems than it solves.

-- 
Matt