Re: [hybi] Handshake was: The WebSocket protocol issues.

[Scott Ferguson <[e-mail]>]

Bjoern Hoehrmann wrote:
> * Scott Ferguson wrote:
>   
>> Your attacker's PHP script is perfectly capable of launching a 
>> non-browser attack against the target server. It's not true at all that 
>> a HTTP request is one of the "things they currently cannot do". Can you 
>> explain why the attacker doesn't just launch a trivial non-browser 
>> attack from the PHP script?
>>     
>
> Because the target may refuse requests from the script but accept them
> if they come from a certain user's browser. The server-side script can-
> not, for instance, spoof the user's IP address, but the client-side one
> can.
>   

IP restrictions aren't practical because clients access sites from a 
variety of devices including mobile access points. A $2 a month server 
on a shared virtual host certainly isn't doing authentication using IP 
identification.

You're now claiming:

  1. DELETE public to the world
  2. No credential-based authentication
  3. Strong IP authentication which forbids the local host, but allows 
arbitrary browser IPs.

That's just plain nonsense. Reductio ad absurdum isn't supposed to be 
taken literally.

-- Scott