Re: [hybi] New port and Tunneling?

["Shelby Moore" <[e-mail]>]

> I will read it next, but quick reply to say:
>
> 1) Agreed, because if the browser has a bug that reveals my session id for
> AsiaDear.com, my security is broken.  I have to rely on the browser for
> persistance, but what I have done is made sure that only a bug in the
> browser can do it, not some other type of vulnerability.

"not some other type of vulnerability."

Or of course any attack in the network between client and server. Moving
to HTTPS would help.

Or of course if any of my client side code has a vulnerability, such as
injecting XSS.

Or of course if my server has a state-machine vulnerability.

etc...

In terms of the point below, once a site does mashups that are not framed,
it gets very difficult to not introduce vulnerability.  Crockford has
proposed <module> with JSON inter-frame communication:

http://json.org/module.html

>
> 2) Apologize for the tone of my prior email about your research paper.  I
> wasn't expecting that you would appreciate my points, but seems I wasn't
> patient enough (past experience sorry). Also if you are approaching this
> from a "what is practical in real world" perspective, I can understand why
> your research would be less "idealistic" than my points.  Nevertheless, I
> hope we can agree that it is a major win when we can be idealistic and
> achieve the isolation of #1 above.