Re: [hybi] New port and Tunneling?

["Shelby Moore" <[e-mail]>]

>>> After sending this email, I am going to take some time to read some of
>>> your publications, so I can understand better your expertise.
>>
>> Thank you for providing public copies of your research papers.
>>
>> Now I am going to teach you (arrogant? maybe, but not desired, just the
>> way it is[1]).
>>
>> I just read the following (in this order):
>>
>> 1) Beware of Finer-Grained Origins
>> Collin Jackson and Adam Barth
>> In Proc. of Web 2.0 Security and Privacy 2008 (W2SP 2008)
>> http://www.adambarth.com/papers/2008/jackson-barth-b.pdf
>>
>> I agree with you. Sub-origin is brittle. Proliferating granularity that
>> does not match the user's capability to manage trust, is self-defeating
>> because of Coase's Theorem (nature routes around any artificial
>> barrier/cost). The user will always try to maximize his desired trust.
>> Thus trust granularity must correlate with the user's trust, not with
>> any
>> other centralized trust paradigm. This is precisely why I pointed out
>> that
>> SOP != trust in my prior posts of this thread. You got the problem
>> correct, but (at least in that paper) you didn't quite grok that Coase's
>> Theorem is the generalization and thus what the general solution must
>> be.
>> Also we must understand the human limitations to manage complexity and
>> that is why my proposed improvement to whitelisting SOP was designed to
>> minimize the complexity and maximize the type of trust granularity that
>> is
>> meaningful to the user.
>
>
> I think it is already well understood that any choices the user is given
> about security are useless if the user can not correlate them to something
> meaning.
>
> My proposal to whitelist SOP does not good if that opens some
> vulnerability that causes the problem to appear at another origin than the
> one the user whitelisted.
>
> I think my categorization of the request vulnerabilities into 2 major
> categories, shows that the user will always associate the blame with the
> origin that was whitelisted, so those 2 very specific vulnerability
> categories.
>
> The next question is how useful is it?

Argh, I am angry at myself for so many typos.  I need to take break.

The should be "meaningful" and "for those 2 very specific".

And I meant "My proposal to whitelist SOP with respect to network requests
only".  I am not proposing to whitelist SOP for client resource access,
etc...