Re: [hybi] New port and Tunneling?

["Shelby Moore" <[e-mail]>]

>> After sending this email, I am going to take some time to read some of
>> your publications, so I can understand better your expertise.
>
> Thank you for providing public copies of your research papers.
>
> Now I am going to teach you (arrogant? maybe, but not desired, just the
> way it is[1]).
>
> I just read the following (in this order):
>
> 1) Beware of Finer-Grained Origins
> Collin Jackson and Adam Barth
> In Proc. of Web 2.0 Security and Privacy 2008 (W2SP 2008)
> http://www.adambarth.com/papers/2008/jackson-barth-b.pdf
>
> I agree with you. Sub-origin is brittle. Proliferating granularity that
> does not match the user's capability to manage trust, is self-defeating
> because of Coase's Theorem (nature routes around any artificial
> barrier/cost). The user will always try to maximize his desired trust.
> Thus trust granularity must correlate with the user's trust, not with any
> other centralized trust paradigm. This is precisely why I pointed out that
> SOP != trust in my prior posts of this thread. You got the problem
> correct, but (at least in that paper) you didn't quite grok that Coase's
> Theorem is the generalization and thus what the general solution must be.
> Also we must understand the human limitations to manage complexity and
> that is why my proposed improvement to whitelisting SOP was designed to
> minimize the complexity and maximize the type of trust granularity that is
> meaningful to the user.


I think it is already well understood that any choices the user is given
about security are useless if the user can not correlate them to something
meaning.

My proposal to whitelist SOP does not good if that opens some
vulnerability that causes the problem to appear at another origin than the
one the user whitelisted.

I think my categorization of the request vulnerabilities into 2 major
categories, shows that the user will always associate the blame with the
origin that was whitelisted, so those 2 very specific vulnerability
categories.

The next question is how useful is it?